Extracted

• • Target

    7c8eb8b61268aa05633afa7161190ee8ed57e80354ded18cb1062cd3a3c945c3.exe

  • Size

    391KB

  • MD5

    ffd95f201b6b78245e7cb9586934f522

  • SHA1

    aa85ccb2d05b9d5826f2ea3d189c5e1f78c24c8d

  • SHA256

    7c8eb8b61268aa05633afa7161190ee8ed57e80354ded18cb1062cd3a3c945c3

  • SHA512

    7f92a57b6cf942d6eaeab003f1bd05e55a5a66011aa22f4a902a3c1928ded90443946f5ad5c61c1baba12a28c29431520aaa3f00fe594983cbdb01c464b61967

  • SSDEEP

    6144:7E+yclwQKjdn+WPtYVJIoBfYo/eyd8/tbrIQ7Oi9Ku:7BdlwHRn+WlYV+RVz/Nr17J

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2