Extracted

• • Target

    Eac.exe

  • Size

    36KB

  • MD5

    501db7f9e10577ddf370a84a1028fd2f

  • SHA1

    65b6db50326b2cc0e6a1ab8cfd8554d2c85fb85c

  • SHA256

    482d54dbacf09579eb9983740b1b58f7aea06733bb13e4a6e6367e338e358171

  • SHA512

    f61bf3d91ed34bbf670bfd003e61aeb69d6de15b4ea66c2c9868de2d6e354b53e0a5abd756124a6dfe705caef5b85706afa507fa3e36e63ba10f100c86307d30

  • SSDEEP

    768:zuQ0MppDsoEASMBQeSJoB0MmA2K3kqgjKb+O1qyg3Y4:b0MjsRJqQw0MmA2K3ktjK4

  Score

  10^/10

  themidaupxdiscordratdiscoveryexecutionpersistenceprivilege_escalationratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2