Extracted

• • Target

    Z1ON Dot Net Obfuscator v2.exe

  • Size

    833KB

  • MD5

    583db42843ecdb4f5ba790beb43572a4

  • SHA1

    a55fc37ba004e327fd9444489ac19789bfe267c5

  • SHA256

    b1f32da53c09893e50094325682f61d0b6e662ab7d1df628dd5167d25b7a7c67

  • SHA512

    98dd5a4b63c6e69d084fbf31a5e48a61050be94f8e8613048fcd056cb1960deeed565c891066d6e9b4114166335a6ecfe5cfdc746955dfa589f89db14df82faa

  • SSDEEP

    12288:HCwqF4Ef4tYimS7hD/4onsU9hCqdTsGyFdfJ:iB4m4tcuD/4osU9hCWsDb

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2