Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    aee9adc778457502a1a34477c8c4ae73

  • SHA1

    f2789a1c6fca778f10e511b57c9dda13ce2f7f0d

  • SHA256

    6ae2eda2d99617d2df7ad5bcb6b6521e96b18cf26d62db6f1521281c90f89d27

  • SHA512

    c9a6f53da6758d1f6e07c65947e4a31b2a2fefc2e560bb2bd4a9c4205c29352ade68cd21b6e81ad5495db75ff8b6460afd488bd66a7c0f66031fb3fc9865b746

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+XPIC:5Zv5PDwbjNrmAE+fIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1