Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    a898c0c9467c303619a0805968854a1c

  • SHA1

    e867a921d0f951f75551d5ca7e10b9e55b4e7bd9

  • SHA256

    d0eb92a63b92b4e1a38986275f2878643b7aacd3fbd4de684cfa6c2f31d6bea6

  • SHA512

    c935ef5d836f96582239625456190e9264cc177eb1e3881ecd3369e8e0d408ec31d0be80965c28aa52d511018ea35f8d6ae371d5c689bcd298a7bee4073ae821

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2