Extracted

• • Target

    2c39458bab1183c727a97880d8bba6a8d234929c7b12c8d978271a738d8e2b35N

  • Size

    5.5MB

  • MD5

    d2059975e7e6214a8586d92f4683a4d0

  • SHA1

    2ea95fcc0451687ba865791b012b222d5f0e4f84

  • SHA256

    2c39458bab1183c727a97880d8bba6a8d234929c7b12c8d978271a738d8e2b35

  • SHA512

    6fdc53a04ac1d231ef5058fd8716d380b73502748c18050e7e2b09c868cb4414d6c01ecde76b139d9a65833361ad801b4b0140a918d9790d87ab545f71d6935e

  • SSDEEP

    98304:VoQDmkhTTmnkN9+6cYwl91bpPuc7q+UGg4tyYdsZdXyv5:VUkhTSnkN9+63YPuR+SdS5

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2