Extracted

• • Target

    Nitropics‮gpj‮.exe

  • Size

    465KB

  • MD5

    ae0671278c558993251145b11d811451

  • SHA1

    509817db1f651ceb1e8a51f6fa15a244b1a31530

  • SHA256

    09c5a6d42c50ec674dc6deacdf2e0a3d2767ea36a6b57f0f4dd70fe8aab84b66

  • SHA512

    f23cb25ea577743fbbc7d14c5265ae90b1cd1ee6dbba3694e8274be6c188c2571d83c362984e22deb6ff9e902cdd3b8b251becafe1e19afb05cfcfe18fe2819f

  • SSDEEP

    12288:bBdlwHRn+WlYV+5XQwmV4gxO+WH7YKkVnF:bBkVdlYA5gwmV4gxO+WH0FnF

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealerexecution

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2