Extracted

• • Target

    Vbuck GEN.exe

  • Size

    78KB

  • MD5

    19bb02eb4df10edd6af6822a847263dc

  • SHA1

    eef31717a1cedf4ad3628092f2cc0074ad9d5b8e

  • SHA256

    783d046079b0d891a7cceee54a03e292efd2eb5941e90a268a0a6331c9805d03

  • SHA512

    4d523d09af36bc0c24e68c9a093cc51ce44aca766ad228cac8706c34b506fcd438efc6a2d4f2dafde0872d78df0c34e64cfc8548742af913d1864c29562486e0

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerdiscoverymotwphishingprivilege_escalation

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Mark of the Web detected: This indicates that the page was originally saved or cloned.

    phishingmotw
  behavioral1behavioral2