Extracted

• • Target

    9c173fbe1731dce2731ff72991b1b2220448418434162fe1b810cd0e01d3d016

  • Size

    105KB

  • MD5

    2502518aa797758d68760e5c46f4fd85

  • SHA1

    27f0b73cea1441a772d9635e4f95441ec754549c

  • SHA256

    9c173fbe1731dce2731ff72991b1b2220448418434162fe1b810cd0e01d3d016

  • SHA512

    59ac66961c7a9945d2c3d062662a8e3fe2161d6498a994404261432f62d0af9df35d94900e302da6cfaa5daf8eb1130a83be88fa4c9f874073519341b84cfbae

  • SSDEEP

    1536:BF67GmLWRSsyLZ6Tt1fk9umda0otZHe7GcAthbTmtDFsyCV1XqFv6Z9Ho4TUYj+R:z677LKvfzftUaHvHQwh6IeyRu

  Score

  10^/10

  executiondiscordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  behavioral1behavioral2