Extracted

• • Target

    drawing‮gnp.exe

  • Size

    429KB

  • MD5

    8a8feb1deb767a7257ae83e7c8ba50a1

  • SHA1

    d82dc1c082203bcd140084b3692a7ac90d030f79

  • SHA256

    cc4f3f1d1faf2fd2fa35be966948bde128b96a42383059a5e251c1ddde4d5bfb

  • SHA512

    55c594387b33493880a32e9ae9cfe19b9277d724f84f9a5e21656f57adffd2f8de93ae9838b260481c148014ac069083eacbd8170596fc94e370ca656f38ad9f

  • SSDEEP

    12288:1ToPWBv/cpGrU3yyJeRxwwJM47j5xPJl1jrFaGi7w:1TbBv5rUV7k73PJlprFaGi7w

  Score

  10^/10

  discordratdiscoverypersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2