Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    62c773eed4a7de263644c82100af140d

  • SHA1

    7553a1b9b0d57f5f30b25c804e83dbb337952e05

  • SHA256

    81e13b9b5ea7654a76d957f74005f5ccb1932b1cc0a682b3bc9006b93fe8ee3f

  • SHA512

    4d8a8c5fb172c21a9c98f8384a7cb288f6c474cc24645c2c0cd3a8e8a7d733382f9a8c6603a3248589e347e944d15451a8938a39ed2d38e2a957d884e9bab2c6

  • SSDEEP

    3072:TbzcH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP+OO8Y:Tbzce0ODhTEPgnjuIJzo+PPcfP+B8

  Score

  10^/10

  arrowratclientdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1