Overview

overview

10

Static

static

7

rostrap.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    rostrap.bin

  • Size

    4.7MB

  • Sample

    240713-yv3pbsvgmq

  • MD5

    e26cd0708de26fc18a2af2ff6fdbddfa

  • SHA1

    201b3445de0070cd054bc67818b2a2090118dcdd

  • SHA256

    76393354a6a3ddebfbd5f53f185849e48c4ab158609ee2a24411ef4ad4a13bf2

  • SHA512

    0a2897a2811b3980daa48c4f61aa66f5ea69d380af076876373276af7435e9c3f3336469b418ea6f314de75ddceb7e8da6c01660c7ebebbe52a40593c1b64bc1

  • SSDEEP

    98304:fb3/VPhspHSrjl3GcqMOFm14O+rHJ49nDZcFMxnh:fjTaHsjl6M0mqO0QDZaMxnh

Score
10/10
discordratevasionpersistenceratrootkitstealerthemidatrojan

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2MTcwMjM0NDQ4ODUyMTgwOQ.G6Bxmp.lZQNCu-ZZ94b9CGCSYHyNJ8h_8sgjGMX0iJAD8

  • server_id

    1261770885514137682

Targets

    • Target

      rostrap.bin

    • Size

      4.7MB

    • MD5

      e26cd0708de26fc18a2af2ff6fdbddfa

    • SHA1

      201b3445de0070cd054bc67818b2a2090118dcdd

    • SHA256

      76393354a6a3ddebfbd5f53f185849e48c4ab158609ee2a24411ef4ad4a13bf2

    • SHA512

      0a2897a2811b3980daa48c4f61aa66f5ea69d380af076876373276af7435e9c3f3336469b418ea6f314de75ddceb7e8da6c01660c7ebebbe52a40593c1b64bc1

    • SSDEEP

      98304:fb3/VPhspHSrjl3GcqMOFm14O+rHJ49nDZcFMxnh:fjTaHsjl6M0mqO0QDZaMxnh

    Score
    10/10
    discordratevasionpersistenceratrootkitstealerthemidatrojan

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks