Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client-built.exe

  • Size

    78KB

  • Sample

    240526-ycqbaahd6z

  • MD5

    65c0da07a900f065d0e646141dbb2c26

  • SHA1

    c226f0d1eb995243973948905557be2d71a968b3

  • SHA256

    7e690350c542b5ef188e025289e1c45de6af63cf76c9f2a481d1106942cbcc80

  • SHA512

    7ce50d126fb3fe3ab29c35ab67342d2f3342a6fa40b748d1f14785f5e78eee83d4791486f9c65e7495793472a8a37595ef649718097ad598c18e27857b37a8f6

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0NDA5NTY1ODUwNDM1OTk3Ng.GQtKqS.OFSoW-g_7DMwUhMpwVakTNjxsEee1_mUG1GGrM

  • server_id

    1244341520782458942

Targets

    • Target

      Client-built.exe

    • Size

      78KB

    • MD5

      65c0da07a900f065d0e646141dbb2c26

    • SHA1

      c226f0d1eb995243973948905557be2d71a968b3

    • SHA256

      7e690350c542b5ef188e025289e1c45de6af63cf76c9f2a481d1106942cbcc80

    • SHA512

      7ce50d126fb3fe3ab29c35ab67342d2f3342a6fa40b748d1f14785f5e78eee83d4791486f9c65e7495793472a8a37595ef649718097ad598c18e27857b37a8f6

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC

    Score
    10/10
    discordratpersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks