Extracted

• • Target

    qwd.exe

  • Size

    78KB

  • MD5

    33d24b41f83ca9261ca0b3ccf6958ac9

  • SHA1

    7c5706704f6d25defcf21a73cfcf1dc0a4d3a77c

  • SHA256

    677e3f181c2103e53a9700fe162e9d39ab8a43001db4ae444ac45670bf3ac999

  • SHA512

    c68da7679537e8b38732c994a60391f95334ff0d1f09a90da5cc35acdd666b168e20203a2c2e5e635fa4a09cfb1744b99b5c6c561f8cac9adcb9366c9032f669

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+oPIC:5Zv5PDwbjNrmAE+sIC

  Score

  10^/10

  discordratevasionpersistenceransomwareratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Disables Task Manager via registry modification

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1