Extracted

• • Target
    photo_2025-12-18_22-26-30_screenshot(1)_gpj (2) (2).exe.zip
  • Size 532KB
  • SHA256 c1d93ff0de35e39b617c5ab6ea5a6352e43303165e40a735cd8ede4014a1f1e0
  • MD5 77f44a52634d2050f3d9bd73d0ab68cf
  • SHA1 0bd19e11db5d09512116148f01caf29db991f264
  • SHA512 755cbfe3029cc35d2b4bf5020460d32c95c04d4e51fb66dc658799f17c0a2a4ef0c830e6acc824704a6c37b9cd0cdd03b1c844b41570edd298ae16dbef3eb3ff
  • SSDEEP 12288:qXrQb5WNDimHQfZuMFcGJXmTJZgM6dg0lSAjma8/Nnaa:CrQkDimwf8+FgTMMoZIYFOaa
  • TLSH
    T18BC42351ADE157946FB39DFC008B8A4BB364D33E6EFB441CA6B9527CE6048C8974BB10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydiscordratpersistenceprivilege_escalationratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1