Extracted

• • Target

    a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941cN

  • Size

    1.5MB

  • MD5

    d0130d6ff7a7b6304c3c1365c81306e0

  • SHA1

    7438a088413ccbd36d63b97b09776a665bb34cd2

  • SHA256

    a34c12fe58a77e2d9dd5f74eb2a1180b2ee578ca2eb2fe49fa1c3d3432be941c

  • SHA512

    5b4b4063a8cd6c81d3cb68057037bb87650fa1486119558a748858268175a963dda14bb7a13bc8e35bf36f7cdf3fb64df5431fc428427a6da15cbf089a3087f2

  • SSDEEP

    49152:4Djlabwz9JzFHkHPl6HG9TJQRehVbY/GBH:oqwvpkvQ2TJXVbY/Gl

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2