Extracted

• • Target

    segz‮‮gpj.exe

  • Size

    928KB

  • MD5

    a30f489a124d3944db68ae2b8b86f44e

  • SHA1

    0e1c7b0c81665bc6b7dd46ba35c3a2a4b1c9cffd

  • SHA256

    9c2b448db764a47f1379aeddd6e0d59ef0325e0dd8d046cff5bdbe8c5c603d00

  • SHA512

    9e7a548d48be22587ab111339f349af5823906a130d7767c9d5c22bca6f99a5f964922b8ae1812e9b0418b9bf70717ee2810bc69d5d6818adda6eef7eb14a15c

  • SSDEEP

    24576:puDXTIGaPhEYzUzA0qhWWwZQ0TkRTuM8EAn40Q:MDjlabwz9hkRTMEk40Q

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2