Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    8e5fd3ee0899fc9a9e6e1993d691f716

  • SHA1

    aba5b08e33095a5ddb68724ebf87387f885e9e23

  • SHA256

    b1bfae1daeb208604bf823a4e5e26092c6d7abdf3b1b7e702480ecbaccf76c7f

  • SHA512

    f2e46d47fd90405d1135f942d8db095d7a72f33c055d5be8e6ed92ec456cf93d855e62f32098cff29adb3e301f73be437ee4c1dd2f43476cc7e4c49aa276dad8

  • SSDEEP

    3072:5bzsH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP5OO8Y:5bzse0ODhTEPgnjuIJzo+PPcfP5B8

  Score

  10^/10

  arrowratclientdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1