Extracted

• • Target
    https://cdn.discordapp.com/attachments/1561594377350946916/1561595188848107540/Desktop.exe?ex=6ad6ec5a&is=6ad59ada&hm=cddc05f31488de886f093a324ea3732fa4de53e6a94b35e28a14c8aa36c46f65&

  Score

  10^/10

  discoverydiscordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1