Extracted

• • Target

    qr.scr.exe

  • Size

    589KB

  • MD5

    e258820afbaf4806a0af98130aa7e188

  • SHA1

    8384adb56549bb90f45feda7f61cf5f316a2e7b5

  • SHA256

    41bfb9975a07c647313b8211c9096fd42c379ef1ab8aa55cf8754903636d57cd

  • SHA512

    bfa53fab0079710ebad1fc05aec58f29a85f5f029b21a07f126d51858ea9ab93cc2467408a96ac761d3b01b3d5636763f6a8446f4830d2c665d7a246e4c40d86

  • SSDEEP

    6144:vE+yclwQKjdn+WPtYVJIoBfnrI3Yraa41Uhmt+5jh4b+wmN:vBdlwHRn+WlYV+mOYrf8U0U16iws

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2