Extracted

• • Target

    CARBOT BOT 2.0.exe

  • Size

    78KB

  • MD5

    f84e3c47d28a741b08c30c7a04c6ee00

  • SHA1

    b45ae22bd44f7228b9c4a0242e65d2af6d2b7b76

  • SHA256

    f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc

  • SHA512

    fb62a0d8f8bf29316b0f3490f267df36248f2b8314ca39bab23b33824372a72460f8d62e4c1875388df6f3d5bdbe494f0a95ec90c9255b23f62a2c5f9d978967

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

  Score

  10^/10

  discordratpersistenceratrootkitstealerdiscoveryexecution

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2