Extracted

• • Target

    Client-built.rar

  • Size

    26KB

  • MD5

    af6ba1335e0280e3e81800867ef4b052

  • SHA1

    de53c6ceebe7804aeadd1e7f242dfe9de194d704

  • SHA256

    dac982d8d07391f73495e886eb7277ad8445be16b3a8dc3d0a5b3b9fb0a13f8c

  • SHA512

    5881e64faa31108a0c15ed249f2a92c2486847d7ad7fe0690b4a96a0a97ca04a2d9a55c79537097789a5400a7fe12565a5d82a063970bdd5abc2944e422008fe

  • SSDEEP

    384:0UYBxLr1xkQzUHfTY5JgUIszmOXVRjL4bSb6yj7V2kUMOTEvsFOViblaRGZyy2ek:zYzkQzsYJVRjkba6yj5LOgU6ibk3PAm

  Score

  10^/10

  discordratdiscoverypersistencepyinstallerratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1