Extracted

• • Target

    720f911303c85d3a7aa374a01d3d926d8db0cf4981971fb80651a3e1b021114f

  • Size

    456KB

  • MD5

    b1dd06c7737e0f8d7b2b390aa99e7900

  • SHA1

    02e3374698f22818cb73b6736e197aa041ea2506

  • SHA256

    720f911303c85d3a7aa374a01d3d926d8db0cf4981971fb80651a3e1b021114f

  • SHA512

    2156784311f9f8114d6729dd3433dbd1951d13bdc3a89273686039c7a18d626bb7c267dcd459e2c9d6b44065085ae2faeeceb9efa691b8930b972a81a049211d

  • SSDEEP

    6144:JE+yclwQKjdn+WPtYVJIoBfORi4ImOkMhU1YIG/:JBdlwHRn+WlYV+3RojRU1Y7

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2