Extracted

• • Target

    CoolMods.exe

  • Size

    78KB

  • MD5

    ca9bd14e43e32ac225ca5a1f0ac78688

  • SHA1

    a14b80b814801e67086735cde8955ecd14b0262e

  • SHA256

    258ccb0c1dbfc2fbe13da1c515f9f903ea7803dbd2a990ad5574763048a3e30f

  • SHA512

    cdcb4b4a2c75b9a65f3612d41160707bab67888d45860aaee83fd44aba998565817feffede5eb9b8fcf0f513adc3d11cc00119d6143d6cfffa60bdaf4796b850

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC

  Score

  10^/10

  discordratpersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1