discordrat | hxxps://mega[.]nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw | Triage

Sharing

General

Target

https://mega.nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw
Sample

240502-qnfl8abh74

Score

10^/10

discordrat evasion persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzNTU2MDUxNjY3MjU1NzA1Ng.GZDFBY.fzBUGyBQFSJ9PEG02ojzoc_vkiKee7lffNWj3Q
server_id
1175458472670801940

Targets

- Target
  
  https://mega.nz/folder/4zkUCBrA#W1jc-wZGaAHyvSmCnivWDw
Score

10^/10

discordrat evasion persistence rat rootkit stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

discordratevasionpersistenceratrootkitstealer