Extracted

• • Target
    svchost.exe
  • Size 3.4MB
  • SHA256 21994949d4df4bdbe5834379c2f7f023c8fa20eb1bdd7a5756f651fe2ff91ae7
  • MD5 69f673730adc1da213f8cce316c2d073
  • SHA1 6e13021078cbc623f0aa28f3ff671676e4871a39
  • SHA512 309a8612c9caf55067e0b4da920f0bc8cf443e98239cfb78d5a1d93fb1b3e6c0243c82bd0f89cecccb45a5f7c9e8b215cd28c02cf33b51c807c90323c846aede
  • SSDEEP 98304:SwbLAPmwkKoVXJbLliE3yZ1sAVEmMSJ6N7FJNmUpdmeI:SwbpwmVZbZfuVENSE/JNmkceI
  • TLSH
    T16FF5333509F64A27C96786F789AEC35EDB7A3B0157C00E4075FF249B14AA5BD3E0A9C0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ogdefense_evasiondiscoveryarrowratpersistenceransomwareratthemidatrojan

  • Family: ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2