Overview

overview

10

Static

static

10

Client-built.exe

windows10-2004-x64

10

Resubmissions

08/04/2024, 09:27

240408-le461adh4410

08/04/2024, 09:27

240408-lezxaahc2w10

08/04/2024, 09:27

240408-leq95shb9z10

08/04/2024, 09:22

240408-lccnzadg7910

08/04/2024, 09:04

240408-k1wlbade6410

08/04/2024, 09:03

240408-k1g3xsde4910

08/04/2024, 08:59

240408-kx8fpsdd7910

Sharing

Copy URL Twitter E-mail

General

  • Target
    Client-built.exe
  • Size 78KB
  • Sample240408-le461adh44
  • SHA256 295cd12d448a0960ae0b2502505bfb0c23b11b651a28ff92f5c04c18712c787f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discordratevasionpersistenceratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTIyNjc5NDI2OTc0Mjk4OTM1Mg.GGcfSn.O22YiEnqD05TMhl029CMEeHyqw41ZN4YIb_np8

  • server_id

    908750895850872873

Targets

    • Target
      Client-built.exe
    • Size 78KB
    • SHA256 295cd12d448a0960ae0b2502505bfb0c23b11b651a28ff92f5c04c18712c787f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratevasionpersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Disables Task Manager via registry modification

      evasion

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks