Extracted

• • Target

    AlbertVacation_nopump.exe

  • Size

    1.0MB

  • MD5

    85e800052c6c4c666ab5b34780683d7f

  • SHA1

    3ad8c16c28271e7eb0e6272f2cbb4379e91ec234

  • SHA256

    284ccf8fa7c86c6e59fb379c82c757a01b170b210f6751e4955c4e20a5f5d7df

  • SHA512

    942a81c0d5dee3a0081c04df9144ee03668831034bc78ed3c36b09f56f5950d7420c4f9dc668f2b80c36765bf9912c2e37964d2151e694fb12a61607a9c5e920

  • SSDEEP

    24576:O0a2p2Dg5NocIAg5ViGcn/IaUcVDQE9bmZdBNKqiRxht+O4l5H53v2LzO+mz:OEgWGpvQI9kDFbDqibhtzkZv2LK3z

  Score

  10^/10

  arrowratxxxdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2