Extracted

• • Target

    Nixware Loader.exe

  • Size

    78KB

  • MD5

    0c3707365415a5dde7293f2109fe0b4e

  • SHA1

    10e64f1087f142bb2e3301d41f5b600933291099

  • SHA256

    0adc04c287413eac1f39fe5abeaed5655c3b74f3ee346646ee2d71fec944f1ac

  • SHA512

    e9b914a6f9b8e434f240ae96072f4bca963bb64e63abcab76a1ecb626bac6cbe6ca79c6eb06872f83a740f7a1ce3eeb6fe44c56e07ba9e7393a1b97581698e90

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

  Score

  10^/10

  discordratpersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Downloads MZ/PE file

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1

• • Target

    READ ME.txt

  • Size

    129B

  • MD5

    2c5536c53452bc76c0ae72a0cbe93754

  • SHA1

    4563f4665294e079c39587dddd5b4030e0de15fb

  • SHA256

    0fbaea921ff1276aa62fc776c5c7fcae64af2e3117baadbdb1f4374364ba7a16

  • SHA512

    af11c4bf4b161689b88ad8de36a4609af8db60df47f4afeb8360c9cacedb02de282b28b27805a506a927072defddb4321ffcf32e5d93b7fdf30748dbc706fe98

  Score

  1^/10
  behavioral2

• • Target

    dnlib.dll

  • Size

    1.1MB

  • MD5

    508ccde8bc7003696f32af7054ca3d97

  • SHA1

    1f6a0303c5ae5dc95853ec92fd8b979683c3f356

  • SHA256

    4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a

  • SHA512

    92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d

  • SSDEEP

    24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww

  Score

  1^/10
  behavioral3