Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    46408fe27686b8558668eb2e4804f780

  • SHA1

    8673f873dcd9107f4ba65599e48274e59e492c68

  • SHA256

    d07fab9f9877d6292ad8cb4de9fde55f86e702bb622c0d10ebfa93f4f1cb8664

  • SHA512

    0906a14110a7b804e76f74dccde960e65634ea00825b2d0da7aef6fb07e7452ecd39182f877e54b05c3fc802ac186737b8ea22595abb617c2957e6eacdc79517

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC

  Score

  10^/10

  discordratdefense_evasionpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1