Overview

overview

10

Static

static

7

SalesAndTa...es.exe

windows7-x64

10

SalesAndTa...es.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SalesAndTales.zip

  • Size

    4.1MB

  • Sample

    240709-yddc4s1grp

  • MD5

    c0b1e4436b0f695734f3354152f6f4f3

  • SHA1

    7916e2f4c0107c768bc66308f2f7dc5cedf2b1f2

  • SHA256

    3c2964a659a4c597aea369db6c7faddd4b314c699839249ea6392feaa8b479d2

  • SHA512

    bf36b6a8ee485c309e51e6d358aef055c68338d744b77a6dfe474fc47e9f0b79d6f59e28d73a7a7769e65c60b5e785f83d28e7d09cd4f68c903290302d68b1f3

  • SSDEEP

    98304:7lSDHUWb5JX09MLEwE8iQSHPRR6w68owtVaYTNd8:78ThHk9MXEhvHOYhd8

Score
10/10
discordratevasionpersistenceratrootkitstealerthemidatrojan

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2MDIzODIzNTAxNjM2NDE0Mw.G_GGTS.fEW6l1WLOhjwEn42Roi-bpXTe-ZL_rK7J-jOto

  • server_id

    1260238572166844487

Targets

    • Target

      SalesAndTales/SalesAndTales/TalesAndSales.exe

    • Size

      4.1MB

    • MD5

      5071e6c3739ca8d176036501ff7b7692

    • SHA1

      0e0ef970dc94a375a28b61baff395043c920484b

    • SHA256

      dc8d4767a1022103802ec64fe86960bea13dd03ff1d0365c2519c7edc07b4841

    • SHA512

      1c9e56a50ac7a3ee175d70b1e456cd69279fe94aac95ea66f4d1f782d2687b33f9c7b0a20d29a49ed06508279dc34f2d4d05ad5fb396a526226e27e93614753f

    • SSDEEP

      98304:iUYt9cvtfCbuDlZM5Arxle1K+O9FbcBvzc8aEB:iUc9cv9EQ7oOx01awV

    Score
    10/10
    discordratevasionpersistenceratrootkitstealerthemidatrojan

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks