discordrat | 893092b2ad575827e3e4141319c95e950a8cf603a2327463c58589c98a2f199d | Triage

Sharing

General

Target

Astaroth.exe
Size

1.1MB
Sample

240616-cyldkazcpq
MD5

5c0aaf1abfda3b4117ee04be8fc1dff4
SHA1

0db1cf8169b9ccbe724bf9c6072fe4330fb86c93
SHA256

893092b2ad575827e3e4141319c95e950a8cf603a2327463c58589c98a2f199d
SHA512

296a080c01c466bbe1e19dc8011adc571d6303e86e4febc5c0651e778899b8c568e4f14fcc22ce18aee05da365b757a20c8e49c645e06ffd2d4ff3c2dda42c1d
SSDEEP

24576:ypbeS0CdSq66yiuhu6RShqGvig4tuF27yFd+eALJUFybP//EC:oZdi6y/o6cMWigKu8+3xoJg0P//EC

Score

10^/10

discordrat execution persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIwMDEzMzQ2NjQ0NTA3NDQ2Mg.GwEY-h.xAAZqHsH5z5QtSAGots9JOAIzSw7sk1O21UHWo
server_id
1202585987616735312

Targets

- Target
  
  Astaroth.exe
- Size
  
  1.1MB
- MD5
  
  5c0aaf1abfda3b4117ee04be8fc1dff4
- SHA1
  
  0db1cf8169b9ccbe724bf9c6072fe4330fb86c93
- SHA256
  
  893092b2ad575827e3e4141319c95e950a8cf603a2327463c58589c98a2f199d
- SHA512
  
  296a080c01c466bbe1e19dc8011adc571d6303e86e4febc5c0651e778899b8c568e4f14fcc22ce18aee05da365b757a20c8e49c645e06ffd2d4ff3c2dda42c1d
- SSDEEP
  
  24576:ypbeS0CdSq66yiuhu6RShqGvig4tuF27yFd+eALJUFybP//EC:oZdi6y/o6cMWigKu8+3xoJg0P//EC
Score

10^/10

discordrat execution persistence rat rootkit stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discordratexecutionpersistenceratrootkitstealer