Extracted

• • Target

    7de30319baffb2aa4db6b00d51b9f03ba15d54bcfb7cd58115c533ebb0884b94.exe

  • Size

    1.2MB

  • MD5

    6a1e9e5b4d55e423d9b2d3dec10f0fe4

  • SHA1

    b2ce7191de0dad914282a8ba4b27e64bbd21c406

  • SHA256

    7de30319baffb2aa4db6b00d51b9f03ba15d54bcfb7cd58115c533ebb0884b94

  • SHA512

    ed5632a347b6670ae6e6ebce6900962de04942f0d4fa2ad2766835d2eecf24e2661255a9410c5e83d8c99a626b5825b20d11496ec160853ff2484a6619b9cf55

  • SSDEEP

    24576:6JpPYTqwhb7j1anIFR18ojgRCHHG/xZQBw6YEEY5JR2DPzovGJ:6wTbb7jrFRCojmCHgZCw6TEY/R2DP8GJ

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2