Behavioral task
behavioral1
Sample
rat2.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
rat2.exe
Resource
win10v2004-20240611-en
General
-
Target
rat2.exe
-
Size
78KB
-
MD5
eb574fb1d907ffd85ce1854f5585d67a
-
SHA1
6b72bc26e0f282010c1c1e5589e130d250d28bb5
-
SHA256
1a3072f72b2747d1bbe6f8aec7945d7753c061cd02ab1a1632963d13ba9e61bd
-
SHA512
0df1476ff05cc2c34e9c84ac4ba7760c233755f8a9f031ac33241aab71cfc1fbba20344b1403620c7f7695360d30ab124cf3557bff4730bd10f8f8b71a580c6f
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+EPIC:5Zv5PDwbjNrmAE+YIC
Malware Config
Extracted
discordrat
-
discord_token
MTIxMTA5OTM2NzcyMTc5NTYzNA.GqkwcX.UOjwiFdGIpv_jY2sOCDo02zExIyfhOxTIiOv6c
-
server_id
1251241660453752944
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource rat2.exe
Files
-
rat2.exe.exe windows:4 windows x64 arch:x64
Password: 12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(12345689wdeuipüdzgwzfwuifiowh/O(
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ