Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    deaf5dca76c8d07ba1dde0c427e72255

  • SHA1

    970a7fe7fbad3038a535f5e92cb45c24875d9822

  • SHA256

    7ecf30ca60d35b0e45c14bf6f2108f7227b06efc456aa91bc1fe0525524f326e

  • SHA512

    c733d3f24f7784bf8468f78713e9e35d6afe2150af9263a3a86c77fe94b41e33c0e24e72fcf0cbdd2aca4e9f388978815580e8e32edfcf2c130e3527cae2b73b

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC

  Score

  10^/10

  discordratpersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1