Extracted

• • Target

    artworks-2HO0OlApZ4W2zXBM-fhGirw-t500x500.jpg

  • Size

    55KB

  • MD5

    14ef17a55225d9610bf1f03a75ea5f79

  • SHA1

    92a6d8d947d0b2a601a7c4453f2483ad016ebdb7

  • SHA256

    47a5b0c1f8136b50b5b25ebf0acab3de999d62fdba3faa12578fd8d6bfdb62bb

  • SHA512

    809f4144b3698cd49358c13048a49efb9666a7de68bf5ecf921b88fddfc3c8f9a33bdf17970b6bbfa096fa6d09c3205d9103a74b6f91a6fdda26748da3eff6d5

  • SSDEEP

    1536:CbsWb/WUt+v186MT3+kQcqwelI6f4Gm2BCNxwF:i3+U+1862+LFIM4WcPy

  Score

  10^/10

  discordratpersistenceransomwareratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2