Extracted

• • Target

    rostrap.bin

  • Size

    4.7MB

  • MD5

    e26cd0708de26fc18a2af2ff6fdbddfa

  • SHA1

    201b3445de0070cd054bc67818b2a2090118dcdd

  • SHA256

    76393354a6a3ddebfbd5f53f185849e48c4ab158609ee2a24411ef4ad4a13bf2

  • SHA512

    0a2897a2811b3980daa48c4f61aa66f5ea69d380af076876373276af7435e9c3f3336469b418ea6f314de75ddceb7e8da6c01660c7ebebbe52a40593c1b64bc1

  • SSDEEP

    98304:fb3/VPhspHSrjl3GcqMOFm14O+rHJ49nDZcFMxnh:fjTaHsjl6M0mqO0QDZaMxnh

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealerthemidatrojan

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1