Overview

overview

10

Static

static

10

keep safe.exe

windows11-21h2-x64

Resubmissions

03-07-2024 18:30

240703-w5swrstene 10

03-07-2024 17:15

240703-vs16yazcmr 10

03-07-2024 17:09

240703-vn4fhazblk 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    keep safe.exe

  • Size

    78KB

  • Sample

    240703-vn4fhazblk

  • MD5

    161e7e7c7c33737fa13cf299f5de7bf8

  • SHA1

    c159f9f2822c45e4f79de8fb59bb19e7e8ee36b1

  • SHA256

    575eda3b9431c8a303be6c734aa85e4bc1b27d547b3f758f71f937d96ef3a50d

  • SHA512

    01ad7f71e02da53088f58f0ee6c02a0d378d9dcd6a0ff61f4f27910681ef8de1a2641e70716e4b77c79ab2a313bcc1afdca0d1bf36e4e2bfe1d0e13fb5ae8f8d

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score
10/10
discordratpersistenceratrootkitspywarestealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIzNDIwMzg4MDI0MjU0ODc4OQ.GnCtHh.ILBrbeZaD2WcnKYL9n7q5C3RNZnunVB1vxbYdM

  • server_id

    1249930029291536444

Targets

    • Target

      keep safe.exe

    • Size

      78KB

    • MD5

      161e7e7c7c33737fa13cf299f5de7bf8

    • SHA1

      c159f9f2822c45e4f79de8fb59bb19e7e8ee36b1

    • SHA256

      575eda3b9431c8a303be6c734aa85e4bc1b27d547b3f758f71f937d96ef3a50d

    • SHA512

      01ad7f71e02da53088f58f0ee6c02a0d378d9dcd6a0ff61f4f27910681ef8de1a2641e70716e4b77c79ab2a313bcc1afdca0d1bf36e4e2bfe1d0e13fb5ae8f8d

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

    Score
    10/10
    discordratpersistenceratrootkitspywarestealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks