Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    a08689d0e211c14402c41e1b1996ec23

  • SHA1

    5b99903cc161a9caf4ad14f60e7039e3046d832e

  • SHA256

    c89e5697ebaa2b07aa8c36669c48a849d456bd019d9c6f58f3d8cf7686028349

  • SHA512

    c6a9f945a78199aee545ff60892fc4c9fdaa0fbbaabd7ecf8c8698043998258f43bd19c168f9c38ed6414f4d57903fd5b7bafca828ab5c60781a3acaa5f24788

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+aPIC:5Zv5PDwbjNrmAE+GIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerdefense_evasionprivilege_escalationspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Abuse Elevation Control Mechanism: Bypass User Account Control

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2