Extracted

• • Target

    NebulaExecutor.rar

  • Size

    27KB

  • MD5

    f44ba3369f118e9cc2611886494cc3f8

  • SHA1

    ecfcbd5f3149762e00298980c79137ee3299be3a

  • SHA256

    b6c7009dd8b089a584aeb6ba37fb75c11a415d63512347beece251e69da5c63b

  • SHA512

    b31cd82c9c490e5dc0358459e7d81f12e2ba4ca092d71e27d078d740475fc5857e758b1c3e3996e69ee989bcf21e0acde9c6eeaaba6f30c9f1ea1bcb1eb3cac1

  • SSDEEP

    768:2/Dgm33+7HbJRN4FnxT+nugwNwlG+sbiVTRsn:1Ou7Hbh4Ftou9zfbmRu

  Score

  10^/10

  discordratpersistenceratrootkitspywarestealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2