Extracted

• • Target

    Client-built - Copy.exe

  • Size

    78KB

  • MD5

    46408fe27686b8558668eb2e4804f780

  • SHA1

    8673f873dcd9107f4ba65599e48274e59e492c68

  • SHA256

    d07fab9f9877d6292ad8cb4de9fde55f86e702bb622c0d10ebfa93f4f1cb8664

  • SHA512

    0906a14110a7b804e76f74dccde960e65634ea00825b2d0da7aef6fb07e7452ecd39182f877e54b05c3fc802ac186737b8ea22595abb617c2957e6eacdc79517

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerdefense_evasionevasionexecutionprivilege_escalation

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Checks for any installed AV software in registry

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2