Extracted

• • Target
    2026-11-02_61b6dda3f478945a00dce59d55c0f863_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 602KB
  • SHA256 6a12e4c9fad63202b49379f57552c6a4600c169214be58ecf440dd36cceb87ae
  • MD5 61b6dda3f478945a00dce59d55c0f863
  • SHA1 54476ea58a95b81987f0ff028117be7e89c7dba9
  • SHA512 f0bb3978d8529fff791c532e93d005655026f6420c5bedc18c768a5ec3bf10b68c873c079b1b66047f7aa2f73da46d9b5f38791c05d33750d1535734c9b48b05
  • SSDEEP 12288:cmiMZvN43+u85Bpw+YMRkc9F4OTbm6XFoj00gQH2:JnvS+55BpfRX9F4OS40gQH2
  • TLSH
    T110D4AF19D7F804FDE0B7E578CD934902EB76B84947B1E68F03A499A61F232909D3DB12
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydiscordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Detects executables containing URLs to raw contents of a Github gist

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2