Extracted

• • Target

    ClawGameTemp.ps1

  • Size

    7KB

  • MD5

    beab656dc763c45a35bf5833fae6349d

  • SHA1

    15e66182eeb30ec6b1b8b37d083108b58e9457e1

  • SHA256

    6f69db9e402c3ced09d2fffff59f5981515853395757dfc131967bd18b3c1689

  • SHA512

    1743c0cfea6f09abbb5370baa2cad9bd3956d3c47c755c8ed4a7c6dd16d7e8df6fae670e60d93a182f97e1593770084a83613b78a6ea45997a2e2fcbb8113bf6

  • SSDEEP

    192:oNQfEMxiPuj8JElIIxshDJ4J9yxWJrAikRhw1Qzf1dovaap0vo9vwvYvMqvUPPRs:/TiPGKiqwa7yXx/3

  Score

  10^/10

  discordratexecutionpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1