Extracted

• • Target

    Supra‮‮‮gpj.exe

  • Size

    582KB

  • MD5

    6fada5257c7697ddfe77aac4dd35bb4f

  • SHA1

    975a043beb300d2220476efd2ed1c2aff01a449e

  • SHA256

    a7fda75ac14b403ed62f4a87fa7ffa55280b934d42a44d96266ef2e1f8e13257

  • SHA512

    b01db0995e776c445267f8c11180f852d39f843aafb38d826f5c2d946c7d0b348e519c1e20642a147a4d2c5faebe0c2292db2bf5e577d3e624e70620ac1a0340

  • SSDEEP

    12288:9CQjgAtAHM+vetZxF5EWry8AJGy0yWphUnWm/pmylo3jwD:95ZWs+OZVEWry8AFBBnPk0D

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2