Extracted

Extracted

• • Target
    https://github.com/moom825/Discord-RAT-2.0

  Score

  10^/10

  defense_evasiondiscoveryexecutiondiscordratxenoratpersistenceprivilege_escalationratrootkitstealertrojan

  • Detect XenoRat Payload

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: XenoRat

    XenoRat is a remote access trojan written in C#.

    trojanratxenorat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1