The malware is typically delivered via phishing or malicious downloads in a compressed .rar format. Once extracted, the primary executable (often masquerading as a crack or tool) initiates the infection. 2. Core Capabilities
May modify autorun registry keys to ensure it launches every time the computer restarts. 3. Network Activity (C2) HIVERAT.rar
Specifically targets browser-stored credentials and messaging client data, such as Discord tokens. The malware is typically delivered via phishing or
Unexpected outbound network connections to unknown IP addresses. Core Capabilities May modify autorun registry keys to
is a Remote Access Trojan (RAT) and information stealer first reported in mid-2020. It is often distributed as an archive (e.g., HIVERAT.rar ) or disguised as a "cracked" version of legitimate software. Type: Remote Access Trojan (RAT) / Stealer Platform: Windows (.NET based) Key Capability: Full remote control and credential theft Risk Level: High (Allows complete system compromise) 🔍 Technical Analysis 1. Delivery & Execution