Extracted

• • Target

    269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5

  • Size

    520KB

  • MD5

    7e26d878b40e1e18d7a8502adb7786ee

  • SHA1

    6ec71f9b6b4ed98c6ad17598cebfd2dbb2002355

  • SHA256

    269a629068ef029d5432e001a3744fa87753a3c62dee5dd022e461f94f849ee5

  • SHA512

    c14613e37c3f7418ab289d92372677251d32663ac49d530d4f249014977e7d89dafd2f1b644dc2a4173d47e89e3b38d436da6a79425bcedb99736d7dee4d0ab6

  • SSDEEP

    12288:EyveQB/fTHIGaPkKEYzURNAwbAg8jTYiGwbc:EuDXTIGaPhEYzUzA0qDGwbc

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2