Extracted

• • Target

    Slika.exe

  • Size

    511KB

  • MD5

    a824dd544e724d77c77fdf2feb2b9b74

  • SHA1

    8fc8bfad4186342ec23bac4e4b6ddc418f95b752

  • SHA256

    5315aba66bce8841aecb2ea2645f0066059e333f05e3ef13bb48316567c644be

  • SHA512

    2e5f8e17e29b4b8888f4b859747b4ef418a71796858b48a71cf86c400db09d2a37c2914add4aae23e217fc9457a4b10905e97dd32be313d1063980df0b39b9f2

  • SSDEEP

    12288:9BdlwHRn+WlYV+510Hb/swEAL194qK3sahwtztDRjrFay:9BkVdlYA5ab/Tfc3s7tpxrFay

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2