Extracted

Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    b8b27b9115947173af300193301fa0f7

  • SHA1

    b9386a3be62a26657a16566ab3e40b7c5d227be7

  • SHA256

    3454313582db126dabf03c20da5f470aff890a4f08d2e868ac1eb3322e89eee9

  • SHA512

    b024008cc9b7f89807309a1e03f91e401544b8b32d961d20477b4476568f41b7e2e5499a76ed2ce62966b0f251be7b825486934c6d2369e38a841ad3ea6d7af3

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

  Score

  10^/10

  discordratmodiloaderdiscoveryevasionpersistenceransomwareratrootkitstealertrojanupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader

  • ModiLoader First Stage

  • Contacts a large (542) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Disables Task Manager via registry modification

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1