Extracted

• • Target

    https://objects.githubusercontent.com/github-production-release-asset-2e65be/514392783/870646fb-c4a4-4baa-8bf8-f817efb7d140?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250102%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250102T040858Z&X-Amz-Expires=300&X-Amz-Signature=837f42a3a6168e3312dc97b90b7cc26de851d35de561440a05e16df3bbcd0aa9&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3Drelease.zip&response-content-type=application%2Foctet-stream

  Score

  10^/10

  discordratdiscoverypersistenceprivilege_escalationratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1