Extracted

• • Target
    2026-09-01_b76d6ff7d1036fd65e0934c5b2ed60cc_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 533KB
  • SHA256 4ef7a14979e7828c0271635883724d4ab0c2f5e74b4f1e7486707a79158b3371
  • MD5 b76d6ff7d1036fd65e0934c5b2ed60cc
  • SHA1 420a322437b0e530f00c987d4e4621c943a09f49
  • SHA512 48771a8b93e2b30237828c8977f1cafc8b2276cac2b9f3c2971fb243f8da70ee9d1e3c340092198637d23a700749a1e274098bd8bc351a7860123a85dcac3c87
  • SSDEEP 12288:TciZ4qN4ZkKdcLtmUzG8G4e9EUz6+pORzJiQ:o25kkKdcLt08I9jz6+pOCQ
  • TLSH
    T1FDC48D19E7F405F9E0B3E674CD924912EB73B8494771D78F03AC99A61F236908E39722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2