Extracted

• • Target

    spoofer.exe

  • Size

    213KB

  • MD5

    71773fceb3e9e624116bbe0034cae4e2

  • SHA1

    795393e8513d7aaaef6e9eadce048083782b5803

  • SHA256

    b1db6f56fd54ccada5e2d84d6830d0dd6474d9016a8882fe9d3ce7c999eb9433

  • SHA512

    43c1fe2be143a47564c163a2fed3063a258006e73a54bad0b4c92a927511a66689ac7272d0ab8f5de966bf1d700f8cdbf6d9931198286f1c0c98f52578186ebd

  • SSDEEP

    3072:UVqoCl/YgjxEufVU0TbTyDDalRmZv5PDwbjNrmAE+UICK:UsLqdufVUNDaKv5PDwbBr4I1

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealerspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2