Extracted

• • Target

    Synapse X.exe

  • Size

    44.0MB

  • MD5

    24054a793dbef0bac103e34b2562ee83

  • SHA1

    defc2e6e91e0136f2dffbf8a425db8b8f29c348f

  • SHA256

    db8cd6e3b3a5a6c0ac092c74bcebf554d593f6ea6d7fd7257a7f3094e48b593f

  • SHA512

    29c181728a4e8c5b13103874673390f57a01c1e4eff5262a13090ce6b3fbf0f7f9bdc90a341bd01dfb171cd464df21c0f945013979b7a4335b92f5a9acc8abe8

  • SSDEEP

    98304:RvmDjWM8JEE1rdGamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYKJJcGhEIf:Rvm0heNTfm/pf+xk4dWRptrbWOjgrS

  Score

  10^/10

  upxdiscordratdiscoveryexecutionpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2