Extracted

• • Target

    Client.exe

  • Size

    158KB

  • MD5

    8619fbf339927746b7d77d1fc558964c

  • SHA1

    e45f4f68931120878c5ec522de72f00294560265

  • SHA256

    9ed8a6a29835c8a77320434e2244fc56a69d6ceccd906006c1f9efe5ec4b6ca2

  • SHA512

    68bb1ed69557909085a906048dacdca1731cc90fcc081bc5bc5ff6ac73d7df009e38756c7a42bbea14ef7de0b4c035cad146c00f4ecc1a4474fdbdf7f5a404da

  • SSDEEP

    3072:TbzAH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfP6OO8Y:TbzAe0ODhTEPgnjuIJzo+PPcfP6B8

  Score

  10^/10

  arrowratclientdiscoverypersistencerat

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat

  • Arrowrat family

    arrowrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1