Extracted

• • Target

    b3f4f9e818ad28ddf5b0da3584e551b8df8e2fb2c1fecaf91fb5595f1693f66eN.exe

  • Size

    814KB

  • MD5

    48ca005cfd24d02863924efc340667e0

  • SHA1

    5360967a58950f6b4fdbac45326878f4097d261a

  • SHA256

    b3f4f9e818ad28ddf5b0da3584e551b8df8e2fb2c1fecaf91fb5595f1693f66e

  • SHA512

    50c1475a7c3985b4712ef7ced0c8385a5c0f0431fe115df9c2f4e2dc10e00b40bce39305ea71d89f5c63b0ad3bfdf69996925a60dc2260c62cd8c540637cf90e

  • SSDEEP

    12288:8LJZSYMYiORE18Uibjk7WqX1ouQgqlzj+znTfipwMPlhaySdXYAbdE7znYYT:8VgY5bGvBQgqzj+3fitP/upYAbszYYT

  Score

  10^/10

  discordratpersistenceratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2