Resubmissions

16-06-2024 14:41

240616-r2knrsxbqd 10

16-06-2024 14:38

240616-rzt5esxbjf 10

General

  • Target

    Client-built.exe

  • Size

    78KB

  • Sample

    240616-rzt5esxbjf

  • MD5

    ecb53bd6e2dcc654cf535d68d3a51ed7

  • SHA1

    ec0f92220186d59e15914cd9665eb06f9e5c30b3

  • SHA256

    2df3388f1981b32ad6e83789b3051d32894388be5aa997bebfe39ce370f5249c

  • SHA512

    28c3b41199bc832349cd794135c81a4af459251a266002ec0db439f243c2d65a81e9697f973e14fc3d213e7f6d8ffef31d254e0a73ce818dc878643e757101c9

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTE4MTY1NzgyNTYwNTMzNzExOQ.Gh8-wx.xiyycDlChj7_zNW0UGw9RXtpwC1XGb_ZUVyHPg

  • server_id

    1250078737546870865

Targets

    • Target

      Client-built.exe

    • Size

      78KB

    • MD5

      ecb53bd6e2dcc654cf535d68d3a51ed7

    • SHA1

      ec0f92220186d59e15914cd9665eb06f9e5c30b3

    • SHA256

      2df3388f1981b32ad6e83789b3051d32894388be5aa997bebfe39ce370f5249c

    • SHA512

      28c3b41199bc832349cd794135c81a4af459251a266002ec0db439f243c2d65a81e9697f973e14fc3d213e7f6d8ffef31d254e0a73ce818dc878643e757101c9

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

    • Discord RAT

      A RAT written in C# using Discord as a C2.

    • Downloads MZ/PE file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks