Extracted

• • Target

    LimitedCheatsFiveM/FivemMenu.exe

  • Size

    78KB

  • MD5

    0f6e652458a3a3374d8fd603163d811b

  • SHA1

    8a546dee8ca4f76c0675a0c95cf1e311faa3f454

  • SHA256

    6ffd88a2de38e3272945a434fd763ddd9a6285372b171765d11a26b9a81e0a85

  • SHA512

    a7cc2b6a58ebd836570121e1b0e373048ba7c4e44c1c02e0c759979b0bee8c0a8d8ab75d7a313bfb6dd6b22baf2d85f514f9c219168e10e98d9d0d1ef1f7c91d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2

• • Target

    LimitedCheatsFiveM/Inject.exe

  • Size

    17.7MB

  • MD5

    157533ab88e43edd48102ed277114d5c

  • SHA1

    4d4032b1850573a7232d31c79df5777df9eff2e9

  • SHA256

    afbde90d61cb5cbd3770d2926e6e32bbb8ad713908d7db72bb46d72ad95f5d78

  • SHA512

    a14b7922f4877cee43417fa83a5e81ce80247c57ddd2290d8df81a4813693da84d923ecbe098af2bc77b8684df6f1abbf0894a61b78a782229f9323c28942416

  • SSDEEP

    393216:gqPnLFXlr7gQpDOETgsvfG9dg+3svEZPD5LU:hPLFXNEQoEe51Jd

  Score

  7^/10

  upxpersistencespywarestealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4