Extracted

• • Target
    2026-07-10_98f2c49123eb2a7fdfe807fe5b932ad7_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 934KB
  • SHA256 af97fd89540da859f63b772800437a06ce27873c281ae00590d487e440de0a3e
  • MD5 98f2c49123eb2a7fdfe807fe5b932ad7
  • SHA1 f019d3a375217fc79d9e791a0ace697a1cb1e985
  • SHA512 c062eaecffba3b568486fb30f1f3161ad29a780f3558b5b83370d0a8392037b93156f691744578a99ff7666f2168893a17ae70e66e72bef2bb68fd3f45382fb0
  • SSDEEP 12288:GhoVY2+LfWvRSECKG4iRkTwkkLRCAhtYuNVbewyu5HO:ab2+CvRSEHiRkTwkkztYuNVbeP4HO
  • TLSH
    T1BA155A4C5BE4CFABFBEED834B842195692F76C8A929C95F7C2405B613D43BACD219700
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2