Extracted

• • Target

    abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e

  • Size

    748KB

  • MD5

    4a50c0fac7e7c8c8bab89a1968d24927

  • SHA1

    8315b29f960059621c67b06ce85d8390df61ae53

  • SHA256

    abaee704f5c196371eb8b92f161135f5d42d9290c92e2ceb1e7dee10a0d15a4e

  • SHA512

    d6916f0a844ba8301a24b602411d859e44dedac5077c589fe9ae205f52dddb40b49bced20d3de41abf4a9a979b6171ee1f6b1318b811e460ec615fe2fd875d8f

  • SSDEEP

    12288:8yveQB/fTHIGaPkKEYzURNAwbAg8f0VXGxnB/OBBh+HqXkGDQv88:8uDXTIGaPhEYzUzA0q6XGxZOBlHQv88

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2