Extracted

• • Target

    f9c11fc00bd4da4b93c834e5f0d65de37658f0b878a9c2b3c4055a8742b6affa.exe

  • Size

    473KB

  • MD5

    b4406153f1df78ecd5a8a9dd6c44df10

  • SHA1

    83cd4551d0087300cd4f08a58b947c6e9a999227

  • SHA256

    f9c11fc00bd4da4b93c834e5f0d65de37658f0b878a9c2b3c4055a8742b6affa

  • SHA512

    6ddb874f324211493445a702ae3cfd9104e3e628f61df6eec5b517b841085a483eaac6eb3234a92e836f307d91dba252f601035a0baea37238eaa7108b925aef

  • SSDEEP

    12288:5CQjgAtAHM+vetZxF5EWry8AJGy0Bs+tGeJf:55ZWs+OZVEWry8AFqcI

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2