General

  • Target

    HEUR-Exploit.MSIL.UAC.gen-5f81e8c57e0fda64b5a61bdeff49fad83036826cb626ba112c6bc7d9698428b1

  • Size

    28KB

  • Sample

    240414-drdwksgg6s

  • MD5

    de690dd604ee0c55fc0a7857abf9e74b

  • SHA1

    f276afac39409ff335af46fb89d56ad47fd873d1

  • SHA256

    5f81e8c57e0fda64b5a61bdeff49fad83036826cb626ba112c6bc7d9698428b1

  • SHA512

    750c830b760b7defb95019f0ab947b5308229944fe7c472185867e0ec1269baf224c6c4a31f06bfd223dd6c060648c2c719ad4af9a50b21443fc61141d209cbb

  • SSDEEP

    768:F5lz6yZDgr9OtA8dozZCLy+d/P58ZjCTFOSUg:Fd2raN8ZegSB

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIxODk2NDQwNzI3OTk0Mzc3NQ.GS7a6G.MN50mEh7UMgOL_rB18LZuCG7dB8Bra64Ihw50A

  • server_id

    1227976374644510781

Targets

    • Target

      Image.jpg.exe

    • Size

      78KB

    • MD5

      d40ef0184cd8a7428374f5b9daf94ba6

    • SHA1

      85bd38a2b5a858c6b5e0608b73f66874c4aa9c63

    • SHA256

      03ac9a5d049067f3b13e2781e336178aa01fab5cb8e7effc5903da08aabcb61e

    • SHA512

      37c4fff56bdec5dd7296d6f0dca05c7c66f73f111fd8da47732c5b82bd6faaacb20086eefa319cbbd1d0e10119644444002db3a57ce0f76d7da12eb4857c4e33

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC

    • Discord RAT

      A RAT written in C# using Discord as a C2.

    • Detects executables containing URLs to raw contents of a Github gist

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks