Extracted

• • Target

    8b3f2f579d9f576c4e65a7e362636322055ebf8b7f418fa5123ddd05498a816b

  • Size

    1021KB

  • MD5

    763bfdc2a902ef6b295a9c6780ce7a6a

  • SHA1

    1ff3debd056c5399e5b61bfcdcade92af4390bfd

  • SHA256

    8b3f2f579d9f576c4e65a7e362636322055ebf8b7f418fa5123ddd05498a816b

  • SHA512

    31ec7923293392245e6c3a60cd2e9d85925808ea00b692329f30281352050ab6a0377a0f74d0ff69027138a45d0c5d221b329cffd305b890d29e99f304ec6689

  • SSDEEP

    24576:iuDXTIGaPhEYzUzA0q2t1XgygZtxenisEKKTv61U781J370qUidLHSvW7cX:lDjlabwz91/XgY8i/I0dLHDcX

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2