Extracted

• • Target

    doxtool.exe

  • Size

    78KB

  • MD5

    16d0fb269db477be08d333641dc063c6

  • SHA1

    135e62c03692f27c9c3217a2d974702acdcfc122

  • SHA256

    c75ed8e67edb12ce91b04dfc1155fe1abb3328fd4e8669bc5a0d64090b62f2d7

  • SHA512

    c474547c749ffaa226c23fe0bc7f2dbd9da36e7ccb50626650c8365bac28f07b90f93c450210a8bcb9166f5f7046e9a69759be4fb9b2e804fd3df6c4adee899f

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1