Extracted

• • Target

    Kgcheat.exe

  • Size

    1.1MB

  • MD5

    cfeee3c91e88223cdf73628e32aa0ac7

  • SHA1

    9aed5554df0198884824667b24f88f65a114c49b

  • SHA256

    d6677579355c01a07792d6ed3678b6e7711111e326f6147a3b447634b5cec5f4

  • SHA512

    60be26bafec0aa86c1487fa26210ec2328f86634a5a7037be47090b68a016c50a57130ebdd9a05b1a32465b49be99cdc60cb375080d51bccc4f7478be875d22c

  • SSDEEP

    24576:AuDXTIGaPhEYzUzA0YT9mf+g8Gd4HXdTbX5U2ZFskFzZ+0:vDjlabwz9YTkwGd43BX5U2Ykvx

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitspywarestealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1