Extracted

• • Target

    ImageLoggerV4.exe

  • Size

    6.7MB

  • MD5

    39ea95d798b42f23b9d5f925578cc179

  • SHA1

    1a2bbf8bcfd835a1349f3219817710a0d3a2b89b

  • SHA256

    6896541fcc9e39d2ac62cc0237e5ae915f2eee398d2f82d09239caae76e27ed7

  • SHA512

    2646b17dc40c18f5babda4a6e87c7a6cd921d51404f05a2e238e4a9df7fda1367b0a153baffed7c45e157c443ad515c44cecbe405c07c310407779cd3c817ebd

  • SSDEEP

    196608:cC8bSasKeCGdjbWGe8cliOZKLtfHPLOAQzZNgs:LYIdS8RO6fHDJc

  Score

  10^/10

  discordratpersistenceratrootkitstealerupxspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2