Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    a2052e280d6b2264a39993ca90f17e09

  • SHA1

    1808a7f26398e9ace8eb0d24e55f74d12fddcb17

  • SHA256

    125991883c09e76a82f840157e6bcfd58cdd718bdd01bbaf531acdace12e3348

  • SHA512

    78edd470591539359c02379a548c3033d170754d0409cb2c0ef8384a4990acc38340803b8aa02f61e0236fded29b9e90b97ade50dd24a6127cde9eac4ad31952

  • SSDEEP

    1536:m2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+adPIJ:mZv5PDwbjNrmAE+aNIJ

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1