Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    0664ef4233864e722f5f0405d95d4383

  • SHA1

    0740cba3719bd0637d3a3888f0cbe588e05c9466

  • SHA256

    69676e5b1f323b61cb1847b46dbab99c649759ae90f38910e3de24e592990a56

  • SHA512

    db56f8da7e66f7022f71e74867249aa8c3bf9065f7a5c62762aafc2e713e9dac3905cae235cdec6ddd10386e8f107672450aa4d43e42190cd36d196f94b5c22c

  • SSDEEP

    3072:MbzrH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPUOO8Y:Mbzre0ODhTEPgnjuIJzo+PPcfPUB8

  Score

  10^/10

  arrowratclientpersistenceratdiscovery

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2