Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    4cc3a192f38f0ba95fa9d68e97f6ef3c

  • SHA1

    be1939d58b92d674a6de1687c66dae7d4dd2ecee

  • SHA256

    aa0316816724b47a30eb700b8034f12e1387827bf6ad4305c81dbe31f2ba1f0f

  • SHA512

    2b8cc93b66a8afd3941baa2ce76a25db53e5843d3751baad6cdc050d8a52c4d84cd23271da6d7781c589fff4352f06e39529e8a80c78e1acb36181be51c253c4

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2