Extracted

• • Target

    silence/silence-workspace.exe

  • Size

    25.1MB

  • MD5

    1061860a4a4866b7c64f3d4d2e1774a2

  • SHA1

    3180d70e4805e09c69db87fac8f9c594d41efeae

  • SHA256

    97ac54425b9d047f3347ec28afa8193ce1be6922338f68844cf16c718bb50cf3

  • SHA512

    8aba1090341ae37b2bb1b3b5095b5feea97d4af9f717747ce8d2eec07dd6f2db25604766f33a2bbc9a02cc3e44df19c063886ff2c736e5fdf3115d10dd56d6a8

  • SSDEEP

    393216:FqPnLFXlrWAQZyRTDOETgsvcGzVgnA/+pWpC5IFhWlXWskIcXyo:8PLFXNWAQZyAEP0OyU8xXci

  Score

  10^/10

  discordratpersistencepyinstallerratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2