Extracted

• • Target
    2026-09-24_32e56932f7d07e79da577465a9daa240_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 504KB
  • SHA256 714faf3e73912eb178451bbf496fe9ca3ed12b8b5774cd63598f32b7538e36c2
  • MD5 32e56932f7d07e79da577465a9daa240
  • SHA1 a2023e65f710f447ec08e0f98f9c82217fd87c1f
  • SHA512 32f0c5c61b660ac3a830b78b9613027c73a38b91c402fc78982523206a4391b9b35a2d699521e3780ef5aac7829b4cc1302af722928150593ed3e54a54b2b7ea
  • SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3lY5tkuzd:qmiMZvN43+u85Bpw+YMRkc9BWouR
  • TLSH
    T1EBB46C19D7E405F9E0B3A678CD924912EB777C490771D68F03ACB9A61F336908D39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2