Extracted

• • Target

    tic tac toe.exe

  • Size

    462KB

  • MD5

    d030b7b8bf2872b8e7eff5256f227e6f

  • SHA1

    5f7d935437cb40224cf7d0cd42c25357bcec216d

  • SHA256

    b61487c5c147a2cce5fde93ecbbbf1fbd43b50d478df10225de3d9a18b490b5f

  • SHA512

    e36fc3ee24afa393da618f923fdd082a759cc75a7e76c060919dfa2e8d30e5a11d2b79d37050113a570106ad032d8aeac1f54146fd660c956c22cb151e23e479

  • SSDEEP

    12288:7CQjgAtAHM+vetZxF5EWry8AJGy0y5bj76:75ZWs+OZVEWry8AFBdS

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2