Extracted

• • Target

    e065095e64a2740805f1bd204910ddd3984140db6e0287a6896ba14f7b478370

  • Size

    653KB

  • MD5

    b29ea93cfaae2ba95253379ed104b887

  • SHA1

    1bbc44a5be1b47fa810932e23f89c561699b12a0

  • SHA256

    e065095e64a2740805f1bd204910ddd3984140db6e0287a6896ba14f7b478370

  • SHA512

    de1efd1015123415f7f701467e7d44b272588a0a6d0f8cef7fe3cdaa07edabb58e3ffa54af13f57fd46aad0094dfdd80e34eee963e280d4e12d7a6260029cb86

  • SSDEEP

    12288:EyveQB/fTHIGaPkKEYzURNAwbAg1UlzC/OrE0lv71l:EuDXTIGaPhEYzUzA0BOrFx

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2