Overview

overview

10

Static

static

10

Client-built.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    78KB

  • Sample

    240523-vkq11ahh8z

  • MD5

    0e8e58e08f0b9c5a95f288a560b871f3

  • SHA1

    fc937d77e49873323493b28654002093d7dd37bf

  • SHA256

    5cab24892fa5986610cc799a122b16d853aa6654a524322514ca0176b5028fd5

  • SHA512

    720a5e4cf68a124824ddfbc7e9926d8233a49ca7d405219fa8f4ee294a1f60ed043ab205fb865c68a0ac969920c3a3b4c269af6b7a3a6a678f0456453c30643f

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIwMDgyMDAzNTUxODcyNjMwNg.GGP9O6.2b4TN5Py_ZoLGGTsEHDM6GPQo0YwssX0RJqa3U

  • server_id

    1200821240789745706

Targets

    • Target

      Client-built.exe

    • Size

      78KB

    • MD5

      0e8e58e08f0b9c5a95f288a560b871f3

    • SHA1

      fc937d77e49873323493b28654002093d7dd37bf

    • SHA256

      5cab24892fa5986610cc799a122b16d853aa6654a524322514ca0176b5028fd5

    • SHA512

      720a5e4cf68a124824ddfbc7e9926d8233a49ca7d405219fa8f4ee294a1f60ed043ab205fb865c68a0ac969920c3a3b4c269af6b7a3a6a678f0456453c30643f

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC

    Score
    10/10
    discordratpersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks