Extracted

• • Target

    sisso.‮‮‮gpj.exe

  • Size

    772KB

  • MD5

    625bbdfe0046fffc786e7a0a27c10bef

  • SHA1

    77795a62395bb6510057682415666f2f1e017031

  • SHA256

    728f6ef5853864664539cd562e33b81138f69609ff37cfcf622b901d2d9d81ff

  • SHA512

    640e062f7fac6cf5d9ce7200f827dd07c0ca9e48210fc35d165143e0ef318de734e818c58d557c077c6e5e270e0341546b8c86a60d37b339a04eb12667e02da6

  • SSDEEP

    6144:ATouKrWBEu3/Z2lpGDHU3ykJy5UMwQ54zUOYwI9CmbkPryNyATXqF0Dp/frNpxb4:AToPWBv/cpGrU3yTiFb3bWXaiRfrJ4

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1