Extracted

• • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    83a9fc73ce6c86ce660bafb0dce8ff31

  • SHA1

    ef1f21ab34d90d7d96dfccaea0f8d9148351f662

  • SHA256

    2e4f582e55c0294a16bbb9edb383a4fb62776bdba6f929d7a44229759650cfa6

  • SHA512

    b03981ada644526b7fafd3c2a0ba9f50ec141e6191c886a1f8449b76c4b8339ab22a96a4d65ff1065a02bff8057995cea4628339dcce87da3e4c0c1d4281b3dc

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

  Score

  10^/10

  discordratdefense_evasionpersistenceransomwareratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1