Extracted

• • Target

    Desktop.exe

  • Size

    8.7MB

  • MD5

    757bcc0d9818642cf387eec015937f87

  • SHA1

    41306ea2814b6722388c0afcae14634b3f60fa80

  • SHA256

    c37a22c31c74ab86ca27a6cc482bc8ab3e38d9865f1875981471ab11698538dd

  • SHA512

    ba25a5859a1291cc3299aa9ea1eddcabef2ffd13ac24a3890a7a4d186c19511cf42b4a9e7d54ddaa463fc7a05a3317df63e67b73831c5bcce803d87bae6f2543

  • SSDEEP

    196608:Aqw6LrkVIEwGgq6TPcYvdAUNseMuakMlSatoZhz+JmpoX6:RAJ6TPHvbf53at0hSm2X6

  Score

  10^/10

  discordratpersistenceratrootkitstealerupxexecution

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2