Extracted

• • Target

    Cute cat pic.exe

  • Size

    630KB

  • MD5

    830d47eb4e4d55d2b878856445fae249

  • SHA1

    4b80adef867d722fbff2bdede95f7043ebefd2da

  • SHA256

    85ad2e6790b045addec97dd7ac9d54e3e3995a259c7485f071041708ce57aadf

  • SHA512

    9196b47e92756584a70d930ae0f7a48f908cde8ba4762b578efd4545bf48b938c0685cbd372a19553f61f0559cadf5fac771a13d36d29fa2e98355bdb08e755b

  • SSDEEP

    12288:YyveQB/fTHIGaPkKEYzURNAwbAg+fmJNax9Jn2x7n:YuDXTIGaPhEYzUzA0KIs92V

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2