Extracted

• • Target

    badassfuckingtien.exe

  • Size

    840KB

  • MD5

    264db47eec711ef618870219832e5dfe

  • SHA1

    116d2ff601d6640d3fe24fb67492ca2c82d9bbd9

  • SHA256

    5c8b1d9c70780e1e669b4b34b0e190f6a691b8ada42179e248513feafe5b9ee5

  • SHA512

    1672cbd9273987fd2d3cb1f843e2e28bb4c107913e0d1562ce6cdd7a403ba40e1bdd05647f3d89b0b00a8dff8328c9fad342f1b771ee391990db6d4855d8ad56

  • SSDEEP

    24576:9uDXTIGaPhEYzUzA0q5VR0cNnns+UrZtb5jpXw86qh:gDjlabwz9iVR0WnQZ5xpA86qh

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealerspyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2