Extracted

• • Target

    bang_executor.exe

  • Size

    664KB

  • MD5

    10185ad8a3e6917c2f81ec3094b66e8e

  • SHA1

    9c3282bb6d64274182e1202d10d82df43ab69fd6

  • SHA256

    f30580d896f81b395049c5dd97eba5cfe786d815aa8d45df8cd1e782ee2de58f

  • SHA512

    88436979af01ca8402bd15aa6ed2024151112c930868f78364d340117f715e0d9383d919623dcf6547f0038b27f90ede257d62db17e9ee2060eae743d05b2347

  • SSDEEP

    6144:3E+yclwQKjdn+WPtYVJIoBf4xX26I6DqJMeRzBrvQNQ5rHeIOohWy0yf:3BdlwHRn+WlYV+Rp2yEMeRzdvY+Oov

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Modifies security service

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1