Overview

overview

10

Static

static

10

GTA5-FINAL...SE.exe

windows11-21h2-x64

10

Resubmissions

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GTA5-FINAL-RELEASE.exe

  • Size

    78KB

  • Sample

    240603-w9akzseg7y

  • MD5

    7ca4d82e1aa342c82da6007947163259

  • SHA1

    7875f56bcbb94747c85a54f8bdd465d866e01965

  • SHA256

    689481c56c91f86cf9e6d034cb714e3c92723af3035c00c3c339fcb384258e55

  • SHA512

    1685a6a2169d1ff6daec4de8c4d48d6035048e2604ff28b4aef6de168785d28c60793d417b9d29bb5e81831c595871f9cdee1aed1eec5f1cbb4dd8f5f746b633

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score
10/10
discordratevasionpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0Njg5OTQxNDg5NTk1MTk4Mw.Gcxhsz.QV1m4KTtP0M77UZ2GaIPNr05TtimA7gY4NjqcQ

  • server_id

    1246899988789989576

Targets

    • Target

      GTA5-FINAL-RELEASE.exe

    • Size

      78KB

    • MD5

      7ca4d82e1aa342c82da6007947163259

    • SHA1

      7875f56bcbb94747c85a54f8bdd465d866e01965

    • SHA256

      689481c56c91f86cf9e6d034cb714e3c92723af3035c00c3c339fcb384258e55

    • SHA512

      1685a6a2169d1ff6daec4de8c4d48d6035048e2604ff28b4aef6de168785d28c60793d417b9d29bb5e81831c595871f9cdee1aed1eec5f1cbb4dd8f5f746b633

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

    Score
    10/10
    discordratevasionpersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks