Extracted

• • Target

    crazyCore.exe

  • Size

    21.8MB

  • MD5

    e6f650829d0696bff1fac6d08b4cdf5f

  • SHA1

    69e19b885dfc862771e94424a9bf037b484aff67

  • SHA256

    bb7d5bba57344040132c5ea0e3f0c503733497d2527bac12d520f24996ba18fb

  • SHA512

    77249c6139bcd72a5e018243ebbb3a3c3caeb1a9990b5f7478a425b0ab9d5f56db97a53845c88caff599a136dc8e542e7ef2761cf48a96e3cc1c25871b305d7a

  • SSDEEP

    49152:FaMUa/U2bmMjbwsd8CCvpX4AjerBV1RphcNwhIF/7MoxYivZcuLH/vpJBXnv6eSx:P

  Score

  10^/10

  discordratevasionexecutionpersistenceratrootkitstealertrojan

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender notification settings

    evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1