Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    29abd40a4fd8ef178c87129181a4fd73

  • SHA1

    bab65aa718e97d07bd0e0732d167333502460f13

  • SHA256

    eb2cd837b0019b8b749f26848f79987728ba6eeaefac717ae295aec3d77f6d41

  • SHA512

    a9df4364f8b4953336b221266f4035e395fbddea8a22b49c96b3d0603c8e6530fff4decdd843a98d0cb3e7ed77bfe2bbcf8e0952f11b6838eb941cff5236fe02

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1