Extracted

• • Target

    do not download and run.exe

  • Size

    78KB

  • MD5

    f2c5e50d71723a255faafb127396b119

  • SHA1

    5784b322726fe05abae13b8dde3c6bcb10eaf83f

  • SHA256

    9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a

  • SHA512

    5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerransomware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2