Overview

overview

10

Static

static

7

malware.exe

windows7-x64

10

malware.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware.bin

  • Size

    4.7MB

  • Sample

    240715-lbnd3ssbrb

  • MD5

    cf3498a5b7087f12b97f746c644bb60a

  • SHA1

    bcb7c90fac1b84c891d54742efc3db9b64b59f94

  • SHA256

    1469af0195b28f87817548a6063a5dd062ab2d0fd77a20b749625ccef01e292f

  • SHA512

    8df02ec2f8aa5ff2da094adaead7c23e158f93db31d3d9ac423ec882c5a26704905f1459b917a97f00a9938092ccc35976d26e6ffab8b5f804c473bebac65254

  • SSDEEP

    98304:WS5vaHahdYUk2TjtDRtVqDRpDv7hl+1jLPtVeNr3b:WP6Y21DRTqDb7GRVeNr3b

Score
10/10
discordratevasionpersistenceratrootkitstealerthemidatrojan

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2MTcwMjM0NDQ4ODUyMTgwOQ.GItusX.BlaHBlSUZLcFqixVU_n9ThfF3DpKJGJou_LNIE

  • server_id

    1261770885514137682

Targets

    • Target

      malware.bin

    • Size

      4.7MB

    • MD5

      cf3498a5b7087f12b97f746c644bb60a

    • SHA1

      bcb7c90fac1b84c891d54742efc3db9b64b59f94

    • SHA256

      1469af0195b28f87817548a6063a5dd062ab2d0fd77a20b749625ccef01e292f

    • SHA512

      8df02ec2f8aa5ff2da094adaead7c23e158f93db31d3d9ac423ec882c5a26704905f1459b917a97f00a9938092ccc35976d26e6ffab8b5f804c473bebac65254

    • SSDEEP

      98304:WS5vaHahdYUk2TjtDRtVqDRpDv7hl+1jLPtVeNr3b:WP6Y21DRTqDb7GRVeNr3b

    Score
    10/10
    discordratevasionpersistenceratrootkitstealerthemidatrojan

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks