Extracted

• • Target

    SWA-Nuker_Setup.exe

  • Size

    102.3MB

  • MD5

    1bd17d81b3b1c041841e0ee54ae849b4

  • SHA1

    98d7cbacda557f5801628ff81b142b14a007edb4

  • SHA256

    34d84b19f195fc4b81bd252bb924d2c4f32e241fb6079d076a83a52054776e91

  • SHA512

    e4af0ea025c9caf231902721d0af3165a23657ce7e660a7686672a2f7b45a0cdc5c49911a2c2bc51d133b254e6b80f177d8f09a50844a60751ee1821f1d88059

  • SSDEEP

    1572864:ri/p7m2/jJGGDf33ZLI9qhgkfAk91Rc/49TEOtdB2BNOj3NVd3Fa3Ta9BOuy3:POl/3ZLI9Y19lEOtdEBA33d3OW9BA3

  Score

  10^/10

  discordratpersistencepyinstallerratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1