Extracted

• • Target

    skicon2.exe

  • Size

    465KB

  • MD5

    fb5b1c35f3747c6951bec44843fdbdbc

  • SHA1

    ab6084edfb98b6ad5b110d52cb8660116eac5de3

  • SHA256

    9104f9b1b4ae7fb9af005945967ccdc8904a22439d0db4e8a61def50d3fadb96

  • SHA512

    1207d5edce59a6cc32487683ff2f993b54c4ae5134c4c4a663cf41a31357ce9b432cf70724f4251edde9f2e239c9beb8f48a04b77b6cb4189a07be0841c240c3

  • SSDEEP

    12288:xyveQB/fTHIGaPkKEYzURNAwbAgB2X+t4GA:xuDXTIGaPhEYzUzA0/0GA

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2