Extracted

• • Target

    rostrap.exe

  • Size

    3.8MB

  • MD5

    3da3fa7ef74e6912844e3b7eea44c475

  • SHA1

    b8078c6b01a37c6b3bce3bd93eb11b8d5b88d37e

  • SHA256

    6e97a3afc6580f3ca0f17a61ee98350d3d3be791bd4c9c3428926e3f40e199be

  • SHA512

    a64cc30dd4f1c44f630bd91ffa6426ddc9af94fc85d40c7c30ec1869748b828362be4efadb6e54fc21f739217d1d587c24d37225f72a0dc4ed09a4a296e99136

  • SSDEEP

    98304:O3GM47lTHdcFcNQBUb4vzWsyQj0jvDeug4WGR/JvY3csQ:O3GTp9ZyS8asyQjaLeugYR/JicsQ

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2