Extracted

• • Target

    bypasser/bypasser_final.exe

  • Size

    135KB

  • MD5

    a1288b1ec6fb4da4f55dc8fd53a6c4ce

  • SHA1

    bead8a51b0c34f981a4b278681f63f3b88f9ad54

  • SHA256

    f7dd8d7d380e311b86e9fb2d61b63eb212e70f5e8e51acdbf47a1dd4ed051891

  • SHA512

    2fa5aa3a0d4daaa57854a9045a12b7e01a0f9864924cde12935646b25f172c787b120bdaac65be85ebe442476c2c1f45b51b737ddbbd2579cf6416e65ab038a2

  • SSDEEP

    1536:2vdWSVRVDlOzjRzrksAOO2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPICsov:2MSncRzAOOZv5PDwbjNrmAE+ZICsov

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2