Extracted

• • Target

    pepe.jpg

  • Size

    9KB

  • MD5

    75494425adf92da992dc799a556f65ea

  • SHA1

    03a82524d97f766d2cd7305e45566e560197a512

  • SHA256

    463a64d183f90599991de74c1b48330ad796fcd7aa733ac1a9be131eaa80618c

  • SHA512

    20ddaec720ba304b644a010bfb3676fe13f64d9e7099e333051e5db43e2563d983fab29565e5f7902b017217ff450f5ce9ad68f2fa155ec780bbdd2914a117f7

  • SSDEEP

    192:PT5eLK+PqoNaK7HrML4vT4ZkGorW+1ewk108rCqbWOqQlW:PlCBbw2xrWkb8rCqKqW

  Score

  10^/10

  discordratdiscoverypersistencephishingratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • A potential corporate email address has been identified in the URL: currency-file@1

    phishing

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1