Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    6efc303244df90861ea895d5e32391ab

  • SHA1

    58a6c06a60b2c5c9d54a78ef217fd7ed1edc7747

  • SHA256

    a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f

  • SHA512

    e943190ca72652b912f30f8620ceb06a850502cc2c088583a82b27e18ce46a0f9f7312812b6cbeb1aa4d045b7349b6828f55e95fca60586bd210944e89f857a5

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerbootkit

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2