Extracted

• • Target

    sonic‮gpj.exe

  • Size

    517KB

  • MD5

    61fbc144acd42d18cbfc6120d4ca62d8

  • SHA1

    ec8c85882a46b554abf6bc7772c0ef6725d6cc4f

  • SHA256

    22ec463efcdbe25769d052b8c7efbc906308b4cb0c9b4a050e9f87d9d3c9603f

  • SHA512

    5c327ede9b0536fe9bc3ca3da93533cc6ae2db51286daa66b75c05042593911c104a4a3a0525080a6be35b1fe224bb0f67ca79fdc82167b1a93c30d7c88c1692

  • SSDEEP

    12288:2CQjgAtAHM+vetZxF5EWry8AJGy0y+qy8qyBqImFFQ:25ZWs+OZVEWry8AFBdy8jq5XQ

  Score

  10^/10

  discordratpersistenceratrootkitstealerransomwarespyware

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2