Extracted

• • Target
    2026-07-28_3d2e9af4ed926a0a0354619a29f90890_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 3.6MB
  • SHA256 20a8b68011e0aa066355c4868a9396176aa0c0578361db2ca1030528ceb9eac8
  • MD5 3d2e9af4ed926a0a0354619a29f90890
  • SHA1 9e797b5ff0e687e784104d5926e26fe4c7cc5d7f
  • SHA512 3292b24afcf1e0e1b7441e007ec828506acc13f0c7778d6834ad35a44729e2e75b0f73ba9556ad73aa4990e172c3eec0649d19c0a67b108cf5608e30cab404f1
  • SSDEEP 98304:rKA7UUPMCXYXYaq2X8hzgJa2dhwi6GwUh54CESl:rjUaMCXYIlRDStjh5Bz
  • TLSH
    T15D062205E7F404F8E0B7D574CD874A26E775BC4A1761EA8F03A4AAB51F632E08D3A712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2