Extracted

• • Target

    Install.exe

  • Size

    954KB

  • MD5

    0252126bad05a1ea6ebe3042b1d177c2

  • SHA1

    9d98900389b76456817e149c779326a994538fae

  • SHA256

    6e25aee49ea9d544165f5d627f53cf0c6983200b2ccb5fa4497d3f32ca99c9dd

  • SHA512

    5fec36049fe76dc68ed5647142984512bbd394db2ba66dd326f6805e158e8814801bb5245cf9de46bc1cb916993813df811339ae3d3e7ed3f9f2bc98398446a5

  • SSDEEP

    24576:YU+9XNrenyktDLdYNtcdvQNC9wHAP5c1gfDrhKh:e5OVeyffXhC

  Score

  10^/10

  discordratdiscoveryexecutionpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2