Overview

overview

10

Static

static

3

SWA-Nuker_Setup.exe

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SWA-Nuker_Setup.exe
  • Size 102.3MB
  • Sample240331-21z26sfa88
  • SHA256 34d84b19f195fc4b81bd252bb924d2c4f32e241fb6079d076a83a52054776e91
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discordratpersistencepyinstallerratrootkitstealerupx

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTIwNDk0MjY0MDY0MzMxMzc0NQ.G9AAm9.Fk5nrTwQ8JA_9NHEVPe9JeTYEAKr5VlDFmLgYM

  • server_id

    1205273351032143953

Targets

    • Target
      SWA-Nuker_Setup.exe
    • Size 102.3MB
    • SHA256 34d84b19f195fc4b81bd252bb924d2c4f32e241fb6079d076a83a52054776e91
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratpersistencepyinstallerratrootkitstealerupx

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks