Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    085a0c1daba783798359d0372f045fc9

  • SHA1

    fb5d4ee0b50f76cf0ad0248fcfd3d86099c0181d

  • SHA256

    f83bc993b1c463a1d994cad9285d14b702c85bc18c27aceac3db80207912edc0

  • SHA512

    14236c9a717eb11e58ad341ff5939217cf50e72a89425a0e1b16266b675d98ca9f0cab89bad97f05bd27dfbe3b83f026a3aa25e54e453675e4a4d13383d39231

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+QPIC:5Zv5PDwbjNrmAE+UIC

  Score

  10^/10

  discordratevasionpersistenceransomwareratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Disables Task Manager via registry modification

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1