Extracted

• • Target

    afc011779e0cbb0f9e2b86054c457f6a0b0a2dcf4a4df09de013c76ed2b552a1.exe

  • Size

    814KB

  • MD5

    477c02d117bd27ba71ea23c7e43e11f7

  • SHA1

    945283d198fdf56b286b27951ee6af7c6eb155c0

  • SHA256

    afc011779e0cbb0f9e2b86054c457f6a0b0a2dcf4a4df09de013c76ed2b552a1

  • SHA512

    3097a138b7c850eb70d7639893c8157b5c546db6732fb337c88ae7573f03ec8c504dbd627c8e3e62f7f401a09ec4816e811e15bf9e8146b258f32e588d7a930c

  • SSDEEP

    12288:8LJZSYMYiORE18Uibjk7WqX1ouQgqlzj+znTfipwMPlhaySdXYAbdE7znYYz:8VgY5bGvBQgqzj+3fitP/upYAbszYYz

  Score

  10^/10

  discordratpersistenceratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2