Extracted

• • Target

    Eac.exe

  • Size

    35KB

  • MD5

    d5affa7d70893d1d29f8d2d0e8e49499

  • SHA1

    0ffe0701303974ef2edd8638abf92a86648e1b68

  • SHA256

    fc4c55249b5a21fdc781db6f092f7a311524ff88db4751f7b3b5f70f66211fdc

  • SHA512

    7361d3ef71a514766538d9b17b6d3c21f4ace1c90a2b102d3729ac3844b72104621267445e162d54201b2341e2f2a7da0e791804b6c0804149fdd1152578044f

  • SSDEEP

    768:GhvFDyd1WrXkxINeeXJMmA2K3kqgjPQ1YeIqC33QBI:Wxyd87kxVeXJMmA2K3ktjwYeLB

  Score

  10^/10

  discordratdefense_evasionpersistenceratrootkitstealerthemidatrojanupxdiscoveryexecutionprivilege_escalation

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2