Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    c91180675d8818997b47da2ccf7abe11

  • SHA1

    68be71d55c1e74ec342400555c2aa46e4adaf11b

  • SHA256

    c328dc708e13a083becaf40b328c3206a7eae31c59ae3b11f163365f44847084

  • SHA512

    bd345a8dac0898cc548ccde1ee8ad83fd63de69abb21f04718eec334142d81414a81ce2b7cdd28fa894d9c9183931fff5693d7dd5bcf3754b08dccac5986cdb2

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2