Extracted

• • Target

    xeroUWU.exe

  • Size

    78KB

  • MD5

    4ec487d0538495c269e0039d081d42fa

  • SHA1

    ecd574e1bbfda1119a778307609e85e6e696325b

  • SHA256

    4899596e68dd4b160a42a14c72f6be0d9a04a714023b0f54d770f8431ff925e8

  • SHA512

    4e778fe02eec094dc56ba55c4a4ebb7c395171acb333c755a9acc6a08e5ae3917b3c5a97c835399f64b2561de1f578aa5952b9376b901ed082617b2287aaeb6e

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+PKPIC:5Zv5PDwbjNrmAE+PWIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1