Extracted

• • Target

    MONSTERspoofer.exe

  • Size

    1.2MB

  • MD5

    c3a422c8bfcfeb9652be8a313f5282a1

  • SHA1

    67a4ed15aef79cad2fc20a89712bb21c241c7b56

  • SHA256

    a6fb6e92dd59821ace2d2d656fcef7d2626549d08d7a9e52128c26ecb0540fce

  • SHA512

    61a2d5ba690a2641bca6e62726096a38f5d32b7403d7afa0a9d213208eaf3b0c51328f5c34452894db388eafebc80ae3c7ac4ba82e55553db29388c9b8c596d6

  • SSDEEP

    24576:iuDXTIGaPhEYzUzA0qQlsYB/CONxCOZRUvXUaUfWd2ucScKDxP+Ua8:lDjlabwz9DVBKONtRUv85yx73

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2