Extracted

• • Target

    16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe

  • Size

    78KB

  • MD5

    e3347a9a35a3397e489ae738b27f7cc7

  • SHA1

    e72a6f4f1fed3513aeef20986cb362e5d2fdfebe

  • SHA256

    16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82

  • SHA512

    a75da2b099bef712bcf87c02aa23e84d5d90f5b0a9e5bb0a27b437ddd6ad777768a1273052e72a720e141db61c4f0ebbe50316df069253afc675a7e46bbb3151

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

  Score

  10^/10

  discordratdefense_evasiondiscoverypersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1