Extracted

• • Target

    menu.exe

  • Size

    78KB

  • MD5

    94b0cef834e50471c6d2a831aa79504f

  • SHA1

    7618db2ba165475ebf98805a88839d4933cc8708

  • SHA256

    5d1c6f43553cfc3e034cca1ae788ea3cc25eb705e2f65ed1c234b70a42eac245

  • SHA512

    715b1fc4a3986dde8d0c901fed81b2a0241cd0dfc3e1ee04b73a7c2bc676ee5de420c84ab3b728950cdb95b4b0d407846114e811347ce42d3712083d58b45512

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealertrojan

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Sets file execution options in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1