Extracted

• • Target
    github-recovery-codes.txt
  • Size 206B
  • SHA256 39f71e042ebce70d9c100b9fb5b6da44d5c3eeb3ed98382f4463a5b20e90e7c7
  • MD5 907f880a652bc579a6da7dab73e0cf99
  • SHA1 a5ad7d14c6b0d5f87bd0aefc301b2244c5bce128
  • SHA512 9a76ed9dc4c940667795f7a1388eebf1141e43e7a262bb4c1019b9c24b3f172622826b9037a02eaa3999e37bd7b3670c9b0614b00fd252f03088012e65399e3d
  • TLSH
    T128D02262426E8FC08AD07888AF33148F22E8EC051132368673BCE21A6400CB8D8C2654
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoverydiscordratpersistenceprivilege_escalationratrootkitstealeradwarespyware

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Abuse Elevation Control Mechanism: Bypass User Account Control

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2