Extracted

• • Target

    A_protected.exe

  • Size

    4.8MB

  • MD5

    2e350ad38505eb0311f8403b7b1c83c4

  • SHA1

    de7648fda593e9efa3532b21fd9f686d8b2c9161

  • SHA256

    5b9c89db8105bb7b2c9e54a61853ecb427b3616985f2906081436864d1f4c2f2

  • SHA512

    b07d6dd091fd57075daabd404b69c97d5b625eb932ad8c84add1ddbbf20dc0527b89fe36b315267d526362a466cf98c725892d6574b100fc0d5cb56d7a545014

  • SSDEEP

    98304:L+fImzx6k9pdkAOfRj5dVL5WfRh6kmCZlkR+14759EcY+T/4ffNr:aok9pWAOptMfRhvFZlkAaEjHflr

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealerthemidatrojan

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2