Extracted

• • Target

    spoofer/spoofer.exe

  • Size

    78KB

  • MD5

    a588fc073017f17b9538be0d7950fe8b

  • SHA1

    db71c1ad51e13f38c5342fa2c84fa45221176839

  • SHA256

    5b25158dadc5ac21c99c100eb9c49f86898dc19959e045f131414ee1e52fe2f1

  • SHA512

    08bdf70710d8e5330f824f971a5585e0b2b3a6516c0a59f5c00fe175b681ecbf25a354c64e1bcb9cb1d5fd0c6401e765355c416e0b860e8da0a4ff72e32ca1f5

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC

  Score

  10^/10

  discordratevasionexecutionpersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1