Extracted

• • Target

    Microsoft Windows Search Protocol Host.exe

  • Size

    83.1MB

  • MD5

    db7547dd16de219ddd802249edc8b836

  • SHA1

    df769131ed7f844ebba99b5bdfd7ee64d931ff86

  • SHA256

    52be3b91781d67fc47a8c57035ee3b7a63157062105833a6e7e37e53fce87487

  • SHA512

    921f7246100917b1a3e8bdcab672adaf6b4f5c493fcec40b355bf883cd3081a7e2f4f2fe92937143dc467a467540876aa64c0631f9e1eb408bd414042f416859

  • SSDEEP

    1572864:cddzlkR0Nf4amAXDtx+SotbqpWCpIPsdNvFw2pdsdW5JzIsqZvJH:W+DaDXdM6lCsH9w2pdsdW5Wbv1

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1