Extracted

• • Target

    68aabd5eb17a4e1025b7e62cbcbc7714ab8f6d371842c7f1561fd62a86e82676

  • Size

    977KB

  • MD5

    8ca2a2f8bf3712a6b5aae42f8d1f68a9

  • SHA1

    24f1b6863ce5c2c1f3a4c8b903225396c13c2e48

  • SHA256

    68aabd5eb17a4e1025b7e62cbcbc7714ab8f6d371842c7f1561fd62a86e82676

  • SHA512

    2ba0b7da5291db079342e64746f1c4cdc78eca563743afe0f07402b62ba7e207f748945a9d92c71fa593f28709830cd93f16c68373e89b9fbf4bccd8e4e5f672

  • SSDEEP

    24576:yHLmCiIhDFr4UhoNFhhX7D9pJcB40+rIU57eUUg90WbHXo:/m14UhoNFhhHp0+rFReFJKo

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2