Extracted

• • Target

    Zenko VIP-v12.exe

  • Size

    78KB

  • MD5

    b88b050994f7c0b3c35ecde9622d554a

  • SHA1

    0b5311ca0657af3d6b4cc10553d275de48bcfbfd

  • SHA256

    62241d46e447e877e794a38451c738bff176e7425f6582a3b1714aa0359ccef2

  • SHA512

    82740e4e3c4e11772950fa7696d1b81fb2d43c67913b87456a5b2742f55f72edc108e11367bc6e09f0c4fa4fc9da3c6213ceea263b8bd292af5efe565defecd4

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerdiscovery

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Registers COM server for autorun

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2