Extracted

• • Target

    ec9f0c246792fc07885b9a30698de7efcdb5016a2d357d84a46c1c8330b61391

  • Size

    596KB

  • MD5

    72ca46638bb4878f9d947b40a500e3e3

  • SHA1

    50f3c40d05ec5a1d05248823a6dfac066543cce8

  • SHA256

    ec9f0c246792fc07885b9a30698de7efcdb5016a2d357d84a46c1c8330b61391

  • SHA512

    c93612afb7a6f20bbf9a4f386a349998d935f2c181fdde40aef196db6a7902c521204e36cbba0655540d2cd80bdeb25c2ceddc67615fb1fde71e621124a1fc5e

  • SSDEEP

    12288:lngM8K8P4ElXddah8kyDIZJ1a+oKl9Qu3JS:lngHKYfXTkXy0ZJ1a/693g

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2