Extracted

• • Target
    roblox cheat.exe
  • Size 86KB
  • SHA256 bc272740ee77ccd42b4900e5a0140145d11e841a9db6598cc35af9c06f9f93c8
  • MD5 432020df29e0c4a262524a39d6a33136
  • SHA1 4546956f99be117083818daa96a0b1cd7fa4144a
  • SHA512 f2cfc8e15c1971ed8a57d4406ad1b26425eccbb041187ff31cab1f4ca3e21b28300072e8b82659fb32f2c382c9ac26a303ba92a1bc7f6b6e2576ec89cf5edcc6
  • SSDEEP 1536:VSS7fkSfnhVqq2S6s2+LSWsj6qDboU8rxv+GcxCvdaHoKV6+fuhJj:ULsfLSpNDbH8rN+USufj
  • TLSH
    T10183DA58B3AC4D13F2BF9E7D24710133CB72F6366969EA4D08CD85F816A1B818950BB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondiscordratpersistenceratrootkitstealerdefense_evasionspyware

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  behavioral1behavioral2