Extracted

• • Target
    Client.exe
  • Size 157KB
  • SHA256 f902c427484c65c3bcd1543072e4c53da376a7ba6151fb6d1ccd990bb7a94be2
  • MD5 c4d6588bee90ee0c7dd9b674199b0302
  • SHA1 a3b5f94a66b3198046fec3dd72c0399b6767e5d3
  • SHA512 24b7ccf87ec5cc5e3af783a6500b1de4f8a381f31e0baf96f7755cca2a92afee310bcfb3c3bf8b7c033f4161f9b53bbcbd605ee281861e3cd59727870e795a8f
  • SSDEEP 3072:+bR3+0O5VbFHexuiCrK0ovzNC0Fie+5cVjvn+sZCh8/QbHb68Y:+bRu0OLoxuiCNovpke+cvnOaQ68
  • TLSH
    T1C0F36D243EEA5029F173AF7A5AE475D6CA6FF6733B07945D2091038A0B23A41DEC163D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  clientdiscoveryexecutionarrowratpersistenceransomwarerat

  • Family: ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Modifies WinLogon for persistence

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2