Extracted

• • Target

    malware.bin

  • Size

    4.7MB

  • MD5

    cf3498a5b7087f12b97f746c644bb60a

  • SHA1

    bcb7c90fac1b84c891d54742efc3db9b64b59f94

  • SHA256

    1469af0195b28f87817548a6063a5dd062ab2d0fd77a20b749625ccef01e292f

  • SHA512

    8df02ec2f8aa5ff2da094adaead7c23e158f93db31d3d9ac423ec882c5a26704905f1459b917a97f00a9938092ccc35976d26e6ffab8b5f804c473bebac65254

  • SSDEEP

    98304:WS5vaHahdYUk2TjtDRtVqDRpDv7hl+1jLPtVeNr3b:WP6Y21DRTqDb7GRVeNr3b

  Score

  10^/10

  discordratevasionpersistenceratrootkitstealerthemidatrojan

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2