Extracted

• • Target

    ZoraraUI.exe

  • Size

    95KB

  • MD5

    57114b780ad5cf03a23b897a7ee3ed50

  • SHA1

    871313b421dddae01c68719546e8e423035bf189

  • SHA256

    e3e46f0d836d7536b5f14324d34ffe38fc337a9c09fbf0429fdd9fe82d1e1ba4

  • SHA512

    dc09eaa39349a2d4c90a904b85bdb8c7abebb83c6e1f00aeb0efcbca09e2444f97550fb0c8ea1600855b77278ccd4834f8cab11f151bf15b7f340a997a069bcc

  • SSDEEP

    1536:l2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PI9:lZv5PDwbjNrmAE+tI9

  Score

  10^/10

  discordratpersistenceransomwareratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1