Extracted

• • Target
    2026-05-07_c88542357423f36d89c0a2186dd3172c_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 467KB
  • SHA256 f1841841e0e6e695297dd513a107393c52c7e526ce8bd4ead514f7b5d0f50ceb
  • MD5 c88542357423f36d89c0a2186dd3172c
  • SHA1 f5045300ec09ed8edf18ecd91f979d76ac56e31e
  • SHA512 c76ed4fa219354bcc78728fc8bcb5066ec7236489dc438aa8443ab97424b99f95a5c5a31ba5562136a9c18b2ff662617fd1eecf8ea1113c23d6ff978a313b14d
  • SSDEEP 12288:zRZeGAfqNGA3Uq29XIDixjpyq0B6QVH/6:zRSfrAEH9XIYpj0B6QVH/6
  • TLSH
    T1B2A47D19D7E404FDE1B7E578CE924902E7767C4917B1E68F03A4B9A61F332908E39B12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2