Extracted

• • Target

    download.jfif

  • Size

    9KB

  • MD5

    560a47443dc4febb2ec9c5179b6fb435

  • SHA1

    2433a15f2139d5c0fed98404d054d2b3dffc7339

  • SHA256

    28c1b6cdf87dc56af461d22506be40c2c715de16eae3fb18bfd06fdf3125b2ac

  • SHA512

    c8fcf2bffb0089dd154687a0d059e5a3f68da94f8d8a01769af2e90e5e7051258b12112f4954c460853b7380cfc0947bd53b0c30078b9e717e72529efcae3b7a

  • SSDEEP

    192:wtAcQE2e43UdNE9Z4ZbE3KosnXa6Meh6e0/V6lOpJPp5hV:jcQfWgj4ZoynXaPeZ0/LpjbV

  Score

  10^/10

  discordratdiscoverymotwpersistencephishingratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw
  behavioral1behavioral2behavioral3