███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

ArrowRAT

rat1 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

ArrowRAT

CATEGORY:

RAT

DESCRIPTION:

ArrowRAT is a fork of AsyncRat that provides attackers with remote control capabilities over compromised systems. It uses specific mutexes to ensure single instance execution and coordinate its activities on the infected system.

TAGS:

remote_accessbackdoorwindowsasyncrat_forkpersistence

[MUTEX_SIGNATURES](1)

[MUTEX_01]

ArrowRAT_Mutex_ArrowRAT

ANALYST: @adhikara13 DATE: 2024-12-19

REFERENCES:

https://tria.ge/230504-pqel9scc96

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2023

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:1

THREAT_ACTORS:1

ALIASES:0

TAGS:5

CATEGORY:RAT

Malware profile loaded successfully