Extracted

• • Target

    8fda268706b18d9918adc6d295cb730008d3ee9d05a097201c1b5c6a4c3e6f11N.exe

  • Size

    1.2MB

  • MD5

    892c0f1d2d7f8d5a359abfd6e4a41670

  • SHA1

    7fd99452dddb1d955770a2fb8e58f376a239d9bc

  • SHA256

    8fda268706b18d9918adc6d295cb730008d3ee9d05a097201c1b5c6a4c3e6f11

  • SHA512

    4c89b5f8719476565169257eb1e8f3912b04c07f51ba22f952d920bc193164fb05b289229802cd6e5a83463baeab8d0c4a9bad9204401426e3dda701821a45df

  • SSDEEP

    24576:6JpPYTqwhb7j1anIFR18ojgRCHHG/xZQBw6YEEY5JR2DPzovG:6wTbb7jrFRCojmCHgZCw6TEY/R2DP8G

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2