Extracted

• • Target

    installer.bat

  • Size

    865B

  • MD5

    2c19299072040e9e7dd5cef468da267b

  • SHA1

    3ab6fad3a10abf8fb5b703eaa3d60244f18975dc

  • SHA256

    07b5ed831d02ec164c13d86d09faa86be7029d090ea12602d5532918ed6f2b86

  • SHA512

    c8519189baf5601af7267f6e38617f58ba16bdbc9b026d7870ac7e584481652f3619e1569b42a9a9d392e6a9d452ca14e63ff2fc1fc5397db45538b9e819448d

  Score

  10^/10

  discordratdiscoveryexecutionpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1