Extracted

• • Target

    rufus-4.4.exe

  • Size

    1.4MB

  • MD5

    7a4662bb7f331d2252f3d949657d821d

  • SHA1

    ad53fddfbcead7b3e6c322c0aad8c4a826bd4967

  • SHA256

    42cdb16f6dd64c4fec30c7a71960fe4d0015862c37e7b02c8dba5c0d68384c74

  • SHA512

    a1d111fc91cd470d36bd4640884b3550c6a4035e8c5bc5176dc9f67aa2ef8be6fc12956d0b351c272d8bb89646546dac868b32d1d1985dee86ffb6e971b14f3f

  • SSDEEP

    24576:wOyBSB04yZT5Z6iqUbVEMs6MrhXlPrBnr/TwcEgzXIdVWLpuL94q:XgZT5ZSU1fUhXhrBnbTbaAIt

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealertrojanupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1