Overview

overview

10

Static

static

10

KEIN VIRUS.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KEIN VIRUS.exe

  • Size

    78KB

  • Sample

    240519-wd6njsad2t

  • MD5

    9f8a43b5ca89a37ac0835c0911f0358e

  • SHA1

    a24e7cecf2e998b6a74a4cbf560dbf97d443b4e2

  • SHA256

    c99c61b9dcbd3ce7fc8596627afa3ed4dfc62c8769cc3e1f7e2296908012ac7b

  • SHA512

    9918fecf89442fb315747dfff40e2a40905fcbd9a4806a29eff14ed88fa4ca47c71efebe813af71fdd295383d6c4e7c281a146e376b4abd0cc0549aebcc4d640

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

Score
10/10
discordratpersistenceransomwareratrootkitspywarestealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIzODIxODI5OTI0NjkwNzQ0Mw.GM_DE9.sCwhiQT-xwZE1RaUtI6kAXfQioIKUFeb-kbyGA

  • server_id

    1241809630498259105

Targets

    • Target

      KEIN VIRUS.exe

    • Size

      78KB

    • MD5

      9f8a43b5ca89a37ac0835c0911f0358e

    • SHA1

      a24e7cecf2e998b6a74a4cbf560dbf97d443b4e2

    • SHA256

      c99c61b9dcbd3ce7fc8596627afa3ed4dfc62c8769cc3e1f7e2296908012ac7b

    • SHA512

      9918fecf89442fb315747dfff40e2a40905fcbd9a4806a29eff14ed88fa4ca47c71efebe813af71fdd295383d6c4e7c281a146e376b4abd0cc0549aebcc4d640

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

    Score
    10/10
    discordratpersistenceransomwareratrootkitspywarestealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Defacement

1
T1491

Resource Development

Reconnaissance

Tasks