Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    1d314f1fc8fae5c78a202bec555064bf

  • SHA1

    c8b4c16f29bdc357052a1e35b5129c788de30f15

  • SHA256

    82732970819d94679571bd75e125145f248f53da7b9a1610c2c8e15723e9a568

  • SHA512

    0484e39eafdcc0a9f7783f9f19286c6410281826cc067e5bfd8940033d29e69c1e0ab5b1b6f8ce432ffa516e4a6ce8bc00ad06854c52d7102b1363ee546fcc6a

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

  Score

  10^/10

  discordratdefense_evasiondiscoverypersistenceprivilege_escalationransomwareratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Abuse Elevation Control Mechanism: Bypass User Account Control

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1