Extracted

• • Target

    28d2206af1219a12a82425a1da1f5df9e15e0914dfe85499c97537154a25c1aeN.exe

  • Size

    473KB

  • MD5

    5c600a8f43d67d163bc2fb24c35f5cb0

  • SHA1

    734c5d573050c4bf42e85f23ae8fd790752d422c

  • SHA256

    28d2206af1219a12a82425a1da1f5df9e15e0914dfe85499c97537154a25c1ae

  • SHA512

    059f54b5805df5137cf6a9f95d72dc1d53d8c31652db4d7c4159ca2ee38f64f4041c5e1e2d664a014654258c0d3dc3282ada2b87d22e60b7a3fd1bb4c5706e95

  • SSDEEP

    12288:5CQjgAtAHM+vetZxF5EWry8AJGy0Bs+tGeJ/:55ZWs+OZVEWry8AFqcI

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2