Extracted

• • Target

    3773543ac5af0235cd44c95ae28bbaec1ed1d8d6c7efeb4e728fc39506cdca54.exe

  • Size

    473KB

  • MD5

    f0bd1b7ccbc18b1227e85ca2286030c6

  • SHA1

    c2caafb0b8099017c1cab9614fa32f2fcea0308e

  • SHA256

    3773543ac5af0235cd44c95ae28bbaec1ed1d8d6c7efeb4e728fc39506cdca54

  • SHA512

    2490df4d8ecdb31fc5a34b82b6f3f4e6bd59c36b9e553c5b73757763bc57bdbfd86fc8a9874fcab9cb162f4e15a4a48ec833fbfa090541365b5b81006f32e66d

  • SSDEEP

    12288:5CQjgAtAHM+vetZxF5EWry8AJGy0Bs+tGeJ1:55ZWs+OZVEWry8AFqcI

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2