Extracted

• • Target

    Napse.exe

  • Size

    78KB

  • MD5

    cfc722721aed1873e23116c5356b6912

  • SHA1

    ac0d0eeada08d10cc09fae392c6999454f33c112

  • SHA256

    125b32da71a719245f993ae15eb527602fc006a34150f1a62ca22aa09a4030be

  • SHA512

    d0ed14e5114f136ace912d91c9d3433255a07c3ad2153cb4a01657dc3e0952ac2aecca36d3453516b586fad1022ecb292019f42b409a9d747127a7360f20f2da

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

  Score

  10^/10

  discordratpersistenceratrootkitstealeradwarediscoveryprivilege_escalation

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2