Extracted

• • Target
    2026-10-10_a68c0e5a87fa1b8bca2e008d23db77b1_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 506KB
  • SHA256 d24e63ceca174e2ce3bda26fc749e7d72fe8f9a6e99af5908911454cbb29fc2c
  • MD5 a68c0e5a87fa1b8bca2e008d23db77b1
  • SHA1 7dd9ba58e9d92ef722fdb7224bd852f77431f895
  • SHA512 8b331938b29dca31321cf2a64511ecb0059ee0886775cfa2aee27ae4c38b4c7d988ab7bdc9ce89d971a59c76b87c5896df70e05ff003763e2facea8743eafd62
  • SSDEEP 6144:iae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH7rAypXt2f:6miMZvN43+u85Bpw+YMRkc95rppE
  • TLSH
    T148B48D19D7E405FDE0B7E578CD834912EB767C494771E68F03A4A9A61F232908E3DB22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydiscordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2