Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    debff807992d6ab1c4d7ce874cbe5c76

  • SHA1

    aa0994bb764049500dd24dc80016712b23fb604b

  • SHA256

    73cffd144f64cb6db1760979226341a2672a1c423acad623665abc20f2b497fa

  • SHA512

    2f620659102d4f1fd065cc857fe2ca25c0ba6f3fc3a9834581a3d9c3b4628191e8a18f08c502e42e4dee98e09efc755a5154e96059a6100446a89c66ebb2e5bb

  • SSDEEP

    1536:WIWOBaZ84c6gEz5De2FzNDnghTAsKFbOZGdndxRKDIZ8Ud0DGMpbDNr1+uexCxoK:WIWOBaZ84c6gEz5De2FzNDnghTdWd7Kf

  Score

  10^/10

  discordratpersistenceratrootkitstealerevasionexecutionprivilege_escalationspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2