Extracted

• • Target
    PotassiumX.exe
  • Size 471KB
  • SHA256 439b66d6ad3778f0d101093e2ff33055ed447ddc56f0b39e5fe91fd33505e649
  • MD5 356f8fdd18e06f59592040ecdd598a0e
  • SHA1 2477c9bba1680bc9546674044862362d5e07e6a5
  • SHA512 87ab8247a773e10a52e0b8af79499539ab6386e38bf40e7509f3f8c720c9379538a666848ccd1a000a15e9e09f7a72ce5522e12a31dceaa8332780f6f47c0d91
  • SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3l+JXYsYzCm0:qmiMZvN43+u85Bpw+YMRkc9BoJXYJCm0
  • TLSH
    T137A47C19D7E405F9E0B3E578CD938922EB767C494761E68F03E49DA72F232908D39B12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1