Extracted

• • Target

    wise logo.‮gnp.exe

  • Size

    231KB

  • MD5

    1c896967e6be98ae74b73609217b6114

  • SHA1

    fa667922c64647c9a7c750e22b9073ab85f84e6e

  • SHA256

    96ffcd21b01c69b09029c9e4e70a2d6471ebbc4a2ed81478a5846083a4228aae

  • SHA512

    08bfc53c47fe6574290b86633632c1efcd42cda7eba6378b3882786d54bd89d3794939fc03b87b8d315c6a55b19d5af6471331f5019a5f42d287d930ee09cd74

  • SSDEEP

    6144:ea4InuJg58BkgqPoDH49n8Bb/cTOUXt8Wa:eat0EAH49n8BlUXyP

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2