Extracted

• • Target

    LoaderBasic.exe

  • Size

    92KB

  • MD5

    46094da1bb8a34bf64fdf689691b2595

  • SHA1

    9b95170dd9c718a14e49396a9f8a374e72357220

  • SHA256

    cb6d814bf564af56be38a29e93aebd665c29736179462cfb9f9b69f946af8466

  • SHA512

    0a1fb7d4d540161501978dde8a141ac899f35e3e8cce0a7a54d712592de9512e86392ed265811f44ecc930a42f17b96cf572d31901cde3646be19cedb99e1657

  • SSDEEP

    1536:EbPuJtGN8F+9okEPBAqcBPDyc5I0bpAkAfLgbGNrE9xCIpOMel53:SuJkN8FwokzBBPDyc5RQgbGNrPlt

  Score

  10^/10

  discordratpersistenceratrootkitstealerdefense_evasiondiscoveryransomware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2