Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    0e8e58e08f0b9c5a95f288a560b871f3

  • SHA1

    fc937d77e49873323493b28654002093d7dd37bf

  • SHA256

    5cab24892fa5986610cc799a122b16d853aa6654a524322514ca0176b5028fd5

  • SHA512

    720a5e4cf68a124824ddfbc7e9926d8233a49ca7d405219fa8f4ee294a1f60ed043ab205fb865c68a0ac969920c3a3b4c269af6b7a3a6a678f0456453c30643f

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1