Extracted

• • Target
    rat-unfinished.exe
  • Size 78KB
  • SHA256 da9ab70e91daf9b7f1df362b79c65d926cea6dbde6eb020d3de50bb64883f0b4
  • MD5 dee5cc0ebadc33fddacc4ebc02167ad4
  • SHA1 25333c10e6e99eb8d293b2744a007c2aebdefd00
  • SHA512 198e21430abff8cdb0ca31f7fe583c43fcea77fc73b12db5b83098e5d91766c725525a31b14686be0d644dab829688c3f1503caea9c610072b010742b308dff3
  • SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC
  • TLSH
    T1DF73B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoverydiscordratpersistenceprivilege_escalationransomwareratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Downloads MZ/PE file

  • Abuse Elevation Control Mechanism: Bypass User Account Control

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Sets desktop wallpaper using registry

    ransomware

  • Suspicious use of SetThreadContext

  behavioral1