Extracted

• • Target
    bingo - Copy.exe
  • Size 6.3MB
  • SHA256 a9952b79cbf65ad877b3c63d3ed7c5493c3f7e2fc851600c05164e2239095756
  • MD5 8b01b043d1af006705d291201a7ec5a8
  • SHA1 dd27c7e2abcf5e74741f63f96178984e5ad33be7
  • SHA512 1c775488f06d2074dc2b913c58cd88d3b976d8045dd677189c9b3bd480842ea2d7efd60461232c7c18b3d374e7ee92731647b9785328cd1dd0297d199c138888
  • SSDEEP 196608:oJv8ZkRg1UdQmRJ8Qnf2ODjMnGydS8pPQd:o9qkR3dQeF3MnG38pPQd
  • TLSH
    T19A663386B3D818EAE867513CC0539449D7B2BD5207B0CBA717F0967A1F476D02E3BB68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondiscordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2