Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    57a46b29c0f70d08631e1897e470bc3f

  • SHA1

    cc32dc5c181d9db744a0e31a4eec0afe019b5f45

  • SHA256

    4a3110951336086dc7a061fbb72ef774c8239c196b69ab77cd68e146892b73e1

  • SHA512

    c3c69f33f40584c91dd4dd41fbdca91515b51e7451379638aa24b782c097c3194c60ed74758b8dd21f7538d3542583bb9c081930c24cb1d1d29febb9b67d120e

  • SSDEEP

    3072:gbzHDH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPPSO8Y:gbzHDe0ODhTEPgnjuIJzo+PPcfPPN8

  Score

  10^/10

  arrowratclientdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1