Overview

overview

10

Static

static

3

Supra‮‮‮gpj.exe

windows7-x64

10

Supra‮‮‮gpj.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Supra‮‮‮gpj.exe

  • Size

    582KB

  • Sample

    240522-rjgt6aea9y

  • MD5

    6fada5257c7697ddfe77aac4dd35bb4f

  • SHA1

    975a043beb300d2220476efd2ed1c2aff01a449e

  • SHA256

    a7fda75ac14b403ed62f4a87fa7ffa55280b934d42a44d96266ef2e1f8e13257

  • SHA512

    b01db0995e776c445267f8c11180f852d39f843aafb38d826f5c2d946c7d0b348e519c1e20642a147a4d2c5faebe0c2292db2bf5e577d3e624e70620ac1a0340

  • SSDEEP

    12288:9CQjgAtAHM+vetZxF5EWry8AJGy0yWphUnWm/pmylo3jwD:95ZWs+OZVEWry8AFBBnPk0D

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0MjgyODA0NTYzMTQ5MjE0Nw.GaK9_b.DkeSn-Pej4eo5IcrUmOmowhbH0dXKH8vZX3FZ4

  • server_id

    1242477718638170204

Targets

    • Target

      Supra‮‮‮gpj.exe

    • Size

      582KB

    • MD5

      6fada5257c7697ddfe77aac4dd35bb4f

    • SHA1

      975a043beb300d2220476efd2ed1c2aff01a449e

    • SHA256

      a7fda75ac14b403ed62f4a87fa7ffa55280b934d42a44d96266ef2e1f8e13257

    • SHA512

      b01db0995e776c445267f8c11180f852d39f843aafb38d826f5c2d946c7d0b348e519c1e20642a147a4d2c5faebe0c2292db2bf5e577d3e624e70620ac1a0340

    • SSDEEP

      12288:9CQjgAtAHM+vetZxF5EWry8AJGy0yWphUnWm/pmylo3jwD:95ZWs+OZVEWry8AFBBnPk0D

    Score
    10/10
    discordratpersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks