Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    9f8192bca777a039d99372a530cdb635

  • SHA1

    a2556acb2ef8989c7d1b07d1744a0b5fd7f58a68

  • SHA256

    9d75cc219fc049368f2dcd1a0e2b6d770c5c00e25e9fcaa43cbffb64beec2f4f

  • SHA512

    9e32db23374ac09ef4833fd1b5e603c294842dc380daca3aa6f2cf27d5be9df081634c589b97f7850c7eadbf672bf3ad5a2f580b6dbb570a68f7280524de3f81

  • SSDEEP

    1536:F2WjO8XeEXFd5P7v88wbjNrfxCXhRoKV6+V+4PIC:FZz5PDwbjNrmAE+cIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2