Extracted

• • Target

    banana‮png.exe

  • Size

    478KB

  • MD5

    4c3c1db7d951b6e6ecfb6e798df7f274

  • SHA1

    ac8c5317b900aed8787fe43bca0d5871c580abd3

  • SHA256

    d11237b84ac5e0498786aa2bb410659c087a148943bcfff4015f044ec0756cb3

  • SHA512

    17fc5f3c231bb3a78c500569b19a2c38f746571d479a613d88a617babae51e7e5aae19f28522b5bfb692b6f0daababfac620ca641850f01f7a988814c95ad37c

  • SSDEEP

    12288:wCQjgAtAHM+vetZxF5EWry8AJGy0ylCGvc+YR7x:w5ZWs+OZVEWry8AFBIGvYH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2