Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    a413b202d9cb6afd42608d30d2f0257c

  • SHA1

    63984f92d8d9ba7a4e78094cf1283e296beb3a57

  • SHA256

    94e424eb08567f890a6136f9018d8255d509cf583c7551b56a4e51ce295f48de

  • SHA512

    5e7dab0f4cdf7ed397e3e9d134265cac13cd3746daf62376ec92a96dc32c3dbc36afc84fa173dd6df017fd98b78186691fae4f2c0468de7f0ba1cab4df805f34

  • SSDEEP

    3072:rbzyH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPjRO8Y:rbzye0ODhTEPgnjuIJzo+PPcfPjc8

  Score

  10^/10

  arrowratclientpersistenceratdiscovery

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2