Extracted

• • Target

    i_like_women.exe

  • Size

    78KB

  • MD5

    5a5b6e53ccb50923996ca249327a7e9f

  • SHA1

    61ac9c582c6e8b47575f7876726e7cd7a858b01e

  • SHA256

    02bfbb334d865f9d3017805f497f796e2e196daac380363c66a400f703e24dd9

  • SHA512

    e90a0aeede476c96d5b58dd01f92481725170de93096fab445a89d40da327553d989f7c15c726ef5bac98cb93e805d434b27174b03d6a11271ece8ab38e242ce

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1