Extracted

• • Target

    friegpj.exe

  • Size

    521KB

  • MD5

    fa686ae2f0713ae1b02296047ebcc87d

  • SHA1

    c07002d6a973789c28091495fc36e7ce1f2db93d

  • SHA256

    445e8e980c9ed096e55898149a625d436686b24d870c0ed08ae81b97ed4d5866

  • SHA512

    1ccb1877fe52a399a1dc4c2ac1de8c3f56772b13cd0bec053558fc90334bd291894b49f57120f0f9388431498df91be082ae5ac7bc18db3b5abc367d521f3f51

  • SSDEEP

    12288:ZyveQB/fTHIGaPkKEYzURNAwbAg8XIAVVsaz1J/CS:ZuDXTIGaPhEYzUzA0qpdzHaS

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Discordrat family

    discordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2