arrowrat | 6a385d1c10d8a2f71c152e70ba97e49fb56c4dd7746cf948d00eab5882a11c60

Sharing

Copy URL Twitter E-mail

General

Target
BawlessRAT2026Cracked.rar
Size 16.1MB
Sample260703-1az4tagw2w
SHA256 6a385d1c10d8a2f71c152e70ba97e49fb56c4dd7746cf948d00eab5882a11c60
MD5 6f3fbeb4b2bd0b6c15ff436e6144c77c
SHA1 8f6b8c8d0510a53ae4642933dfd03f65dc3edacc
SHA512 c0cd2c91686b7191478d28782767f820e2bb79a1a558a3af7ca9d4469e7809b5de40d2f409b68763cc18fe8aca9de69bdfb2ae6afa626c4d31a3e9feede9f1fb
SSDEEP 393216:rkz/CO1znmV2iyg+Sl0YZAp/I3rovPm9vGxEZTgrgx+Ik:4z5nmV2iyg+Y0Ya5QwkvGxEKgI
TLSH
T14D0733C276F4EF4F020DF895916854CA82530DBEA25AC854BA550D7B3ECFDCC29398E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

arrowrat asyncrat %group%adware defense_evasion discovery execution persistence ransomware rat spyware

Malware Config

Extracted

Family

arrowrat

Botnet

%Group%

%Hosts%:%Ports%

Mutex

%MTX%

Targets

- Target
  Bawless RAT 2026 Cracked/Bawless‌.exe
- Size 9.2MB
- SHA256 3cfbde12f33e8bdd3d0c9e5f665ac851af1031821c1b502923d7ce5cbd2a8196
- MD5 9bef8d726b976337f0da099a18f613d1
- SHA1 5ff93db8131054bfdaed154909435a8144b04c7e
- SHA512 b040d3b819ddcda758e6d3e92037e142e8b581a34466586d45248d9ea7dedb4cbc447fee41fdf9639190a2881198231d7ee5e6585628d2a0117062e2b1dcb8f3
- SSDEEP 196608:mSFu/Ju8JKtaoPEcIG6XF1ud2pf6o5YwgfUfg0mvl2:fae9Ec+Pud2oo5/gfwu
- TLSH
  T143A633E75ADEE149EDC925F7857F4A9202B02D05E9D787E3239854B35CF5A280BCF820
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery execution persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  Bawless RAT 2026 Cracked/BouncyCastle.Crypto.dll
- Size 2.5MB
- SHA256 5530dff976bc0c889076b97ca695bdb97ef07f63449d32f893ed32398ed8bfe6
- MD5 3551343fab213740bbb022e3a6dcf27b
- SHA1 de67fb4f9d58db4a860a703c8d1f54ff00ff9b1f
- SHA512 e90f51053e1d4b0ea1f7458229de92174abf0781c766290da4de5cc8dfcfb730998252bf28b36ca5070978fdcea8b97f0aea6a47b875dd34173643ac0cb46c42
- SSDEEP 49152:3CTzhVM0AU5d3UOhq8hmReOUJfd5T3D+VTQlgQeCKbu9kQLO0:GwU5d3vhzhmoOmfd5rqX0
- TLSH
  T128C53A086BF40A27D6A9E7B5D9F01021A3F0F43EB353FB4B259267B54C17B654C422AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Bawless RAT 2026 Cracked/FontsInstaller.dll
- Size 371KB
- SHA256 3c357e4d067d2c9322b6d4a4a691698913a76570982af561c6c9438832f42ccc
- MD5 5063ada08270d629a051121a8ecb4160
- SHA1 0e2d0391523fe5595c408507f7b80918bfe23552
- SHA512 d9eb54f867ca0796dad47e9ebc5c40ca055a0bea90868220c6ae6dc6ad4d863dab24e38f51284fb33d7733f8034c384c8044946c14d92553a7b3a0dd379ad13f
- SSDEEP 3072:BZSayK7cup8yzxJQKhopX4Etl8Q+/EHz8c/TzyGl+qF0HWN/InbBv8ZtSOQ9duOk:D7ccWXPETcr0qF06/0bytQ3uOFXA
- TLSH
  T192849620B015AD50C4F9CF7E494295B48D33DE77C1A6A51720F3B45B22AF792EB28A73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Bawless RAT 2026 Cracked/Guna.Charts.WinForms.dll
- Size 823KB
- SHA256 09906a9154b088e3b86909ed960c961e874a07543d6ef44ee2a48142c4d5adde
- MD5 70fc3b097dbb077ef99490da7be6fc15
- SHA1 030f93bf4ec0774d15765cd556fd497b6b361fea
- SHA512 731dc886db45a4f1526897cdb2de6f75107d4a3b8bf82204afbdad01634ffeba49ff0266f02c5be438a47ec244059c537897fbe4acd3f239c81d3208781c99e3
- SSDEEP 12288:GCDHQJwtQyqXCeyYECAHAw+cL7xCfaYagqScIsTEHxRPs:GC8JwgyNl3g
- TLSH
  T1D7057D259F897627DB7ACF3286C9551AE1F0789331B3C94E39D387C80701B8639C6A6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Bawless RAT 2026 Cracked/Guna.UI2.dll
- Size 1.9MB
- SHA256 d590f05dc6980e4681243e68bda05b7da7952d75d4aa34963c1535f79c8fc060
- MD5 c1789e4cf0b77749e0bef8f984f9cd6d
- SHA1 cdf9d3f1c45bf294380d59846ae26b9da8a65725
- SHA512 e51e76476d5c46d467bbf92a25471e6525a8ea58a4cca7ee305b295b396cb53650169665979eac0ed9bebb38c74d62c03e2f3b29b70eb6eafaf9ba474fea33ca
- SSDEEP 24576:S5lxfKZ9DrFowbpl84NbJ1k+BAeWUo7AHQ/jz31RMIt24:kB4Nb3X6RMIt24
- TLSH
  T1749507106ED19E16D16F4E33D5E35010C7F2F4926BB2EB0FB2D5A77C145338AA88A366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Bawless RAT 2026 Cracked/IconExtractor.dll
- Size 10KB
- SHA256 2c359ce857982f45b09af49dbccfb2ae302839acf1956e8325e7f854b339a8c9
- MD5 7bcf61e29e5cbcd1b81d9ab72cbfed93
- SHA1 d082613177dd1711c18426d4f83921dd932bc7b1
- SHA512 ce84af38dc63374d304d4e3b6c098892588df5ca5e921505c410b2a24ec0137dbc3120bc713cc0e4bf7836c57b7db224dd3264ea454cbfdb1ef78c9ffb19b6d9
- SSDEEP 192:vyB0L3vIFktNlrgyLY5ZJeU5cs7hnvR952:vyeL3/gyLYPJR5RJG
- TLSH
  T1C8223C89FBE90A22DFB70736A8039E81637CF6149557DF6B08C901B52C667940F12FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Bawless RAT 2026 Cracked/Newtonsoft.Json.dll
- Size 685KB
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
- MD5 081d9558bbb7adce142da153b2d5577a
- SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
- SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
- SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
- TLSH
  T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Bawless RAT 2026 Cracked/Plugins/Audio.dll
- Size 25KB
- SHA256 1323a7212239513270077e07cb436af721acedb0c21c99b06c163a230baaa50a
- MD5 025864d133e416f144030cf22ea9f2c3
- SHA1 6be2cb2454335f0de00799000f65c5cee796c185
- SHA512 ccda6ef9847f89e53adaa637c7f762be22506b8b6bd2a5538b6622c33f3244f9c491e39e7df7512b5edced3d0395e4541b182f7da6a254b8891b9d64d71538b2
- SSDEEP 384:si+z4JdSCmRO5Gw5ZGuC0CWdseXGKfZ0CDzukNpLQ3s6XXLca78nOtX:7zJds45GwRC63lF27AOtX
- TLSH
  T195C22A069B64C7A7DBAC47B958B353044279C1AEB503FB8B8CD460F21F167DA1B316CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Bawless RAT 2026 Cracked/Plugins/Chat.dll
- Size 456KB
- SHA256 dfa246c2763bf5df442a81128b3587f7bf530e4327f631cdd4dd79106738cf31
- MD5 8fc1192cf52f55ed5efb5e12210a37bf
- SHA1 dbcf714d0d9b0fe44bdfe2ee150227c2a0e7c387
- SHA512 74603de6069cc6bf02afa5cfc3ba1493240bcb7c74fcbd53219448134b79fb5ebefc1dec61ac4c6a04c56dc6d986887a4a68d87ae1dc07ba6d1d8b8afc9d480c
- SSDEEP 6144:CtBlKJ+p4JX0cZsaB6N83r2y/plBWnxfID/uKNlNQ7fOiLXyCrxO9w+KQqxe/tT:CVKTkcZBB6NKbBWnxfIvNr4siQqx4
- TLSH
  T11EA412C26B18C212C73D4ABAE5A7A1F14265AFD6D815DE473D913C9D36B37CE8012AC3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Bawless RAT 2026 Cracked/Plugins/Discord.dll
- Size 27KB
- SHA256 6a43095314d5e32db307eef638d2f5afea7dd40ff6acda24fc28ce0c1632cb6a
- MD5 b591cff18fd7344243cf8a4eca624a65
- SHA1 29f9134bb33d429d27b87e6f2112b6753e1dcae4
- SHA512 ae1aa8db37182a4b8ee06249da6304c1c105adf06b2091cf24b3e79ad1d6d1a6eaab12bf059cd86deb04b7084d563a25d5bbef6ddf7857c1a34fc0e0032664fc
- SSDEEP 384:HfzPwa/ppmIwuCfMeSmfbQFFVBdseXG3cGh+JaL6lkSggL5XxXIUdwmuJpSVmlY2:HhGIwhPgh0Jd+5XxjwmuJpSV/I7
- TLSH
  T155C23C066B94E777D7BC47BC997303188378E2A6E603EB9A2DD450E259133D90F11ACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Bawless RAT 2026 Cracked/Plugins/Extra.dll
- Size 34KB
- SHA256 dae673b838de497c1aa8a558d4dd5963d90e8b21538cb0d9adce585ef6fbc915
- MD5 17db58471bf45715ba46b5af7920d676
- SHA1 0ab236a6d554597dac8fc40fc3e1a29f905c0275
- SHA512 29432c0d19be6ae8c8ab68ab1a7c4007d502222b329f9a0bfb994427f182028aeeacc199dd27334cdc0adabbdee7a07a3d24826ed67b05711c2370a4b7395265
- SSDEEP 384:0hfLE8JhqmxGhnGOheE6qCtdKudseXG5JN2ahDkz7R3bu6jUwv5YacMvvp8D5K8:wQ8hxGWCkQuMPkv5YdAva9IKqbnMK
- TLSH
  T1BFF24C027F68CB37DAAC0B34AC7713244376D697AC13F74A6C9060B5A9437DB46242DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Bawless RAT 2026 Cracked/Plugins/FileManager.dll
- Size 34KB
- SHA256 50f93055604c7418fa0e5536afd0b4d535db752b5e7edf588cbc14c1570613a1
- MD5 dab76ee6ff2548a9bd45c0e582f4d90a
- SHA1 70b0e615c1728aa8198dd4be4899fd883bffa1d9
- SHA512 431f38a2b08c5d9f9914a05eca7a32084b3b33d473cedb91904776417c49d8599ec81c905a857a118e8d6b39a200accd14b1c21a35b1faea760084fd75967501
- SSDEEP 384:V/fLIMFZcuWQHBVugXvYhXmovTuC/Jn/KddseXG/htVhD8mouoFFAEFuc0oOJPtp:9pBQ2ovTZ/kdczcFhntYtny1l1E
- TLSH
  T19AF23B063F94C227D3AC477968B3532802F9D69B6A03DB4B4CD560E16A237CA6705DFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Bawless RAT 2026 Cracked/Plugins/FileSearcher.dll
- Size 280KB
- SHA256 a91d0552200064646768b1fcd393568ca6144279ef0543aee6a74c4d11c34f49
- MD5 a186a27b6e893b60bf236120a6a329a7
- SHA1 9186d71d524f2716c7ad3e934e134aa68366006e
- SHA512 f5acc60bdcf71eea700af6c6372e68d58cac1008a6fc2850dcde1c59310cb84527725740f646be4a146adde6f0878781101670ce922c3566b34262da857aa847
- SSDEEP 3072:OUI94v0G+OSJqB7OOaJOqX8s28ccc9k16uLWcSCSLeNYcEeI/KQ73WmbaC4nRZkp:YKWOaG4X5S9k1zbB6YF6X
- TLSH
  T11E544B446BE4CA5BF1BF37B6D0F2526187B4A452F93EEB8F9D4010EA1903340D9217AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Bawless RAT 2026 Cracked/Plugins/Fun.dll
- Size 36KB
- SHA256 2b25c33a033bdc85ea4db8c3ea89bbfc7d1a1dd80d21a1835bba5672759efdd9
- MD5 e07004ec43ed994b9a11999145f5a43a
- SHA1 00cba09ae5a38dcfdbac1a8cff9cd1fff2c0b3e7
- SHA512 39948577cf0185ffbda3c2757c7fa746e41a169ca7fa0a3718cc564fbbec439b047bc540fbd5ac59908965424ef11f6564d9795b101bfc58656247e76b0c88f5
- SSDEEP 384:T7fLviWK1Xr4GtVmEc6BktslnlrqKQdseXGtrR52bhimwy0Xprnhc4r/f7rpVqKX:fGXFEGtMqS2lnhQk95Z3nhXrLDUCE+
- TLSH
  T1DEF26D05EBA8D667EB9C0B7CB4B353188375D0A3B513FB8A4CD420E62E077C60B556CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Bawless RAT 2026 Cracked/Plugins/Information.dll
- Size 27KB
- SHA256 9fbfd1036e579edc9498625e86c45743e4ad8ecf5960f4a87a9402ba1236448f
- MD5 a7670d3509baa51af6566b93b185b854
- SHA1 2b322b936eea3dd5414efe589acab3cb49dfe9b2
- SHA512 34999ca9b71de6ed4a3cc99177ee472bf90af9282a095d2cf6b05f17e896f518b46382aee021b540f5422c0997680023206b1281013c468a72116cb646a89882
- SSDEEP 384:BRfL6mS8ayvHxy63m+tDZdseXGEXNhDYLuA7InXxtXciyxVM6d0PALKz9G+mZ9:nBS8x72+1ZTaIn3siOvePALKs+m3
- TLSH
  T1B2C22C02ABB8C727E79D0F795AF3030847B5E5999823D74D5C9020F61B2B7EA9A107C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Bawless RAT 2026 Cracked/Plugins/Keylogger.exe
- Size 10KB
- SHA256 2e6e13e2498910dd511c5eb7a53e29920f8d4bf506df97bd209a27d776ae9068
- MD5 7ed065eaead4459e1b802715367b57d9
- SHA1 70bb5500f80c3c71fbaf7adaea527c16bfca316e
- SHA512 750ffd5a77f74b2d3bbbbbd83ec91b67193d8ee82780c2bb8e389ea844f16c82c693a8696687bb0e2ab87a77cd3794155857a0124f15124957b8acbc47bcadaf
- SSDEEP 192:Ctmcuq65SoDxi4maEYbRzmEsLkjgv5JHTCeJYHcwY7fazDZEi:CtlF60GE9rUhVsLF5pCrYyvZE
- TLSH
  T1C2221981B7E88775DD7927B6ACB347501A70D2055C77CAAF1898111E3EA72410B83BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32