Overview

overview

10

Static

static

7

b7178a09ec...b4.exe

windows7-x64

10

b7178a09ec...b4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7178a09ec2b18d3ec02b0b7c746e27605bee55dc05969d67beb054c38f410b4

  • Size

    4.6MB

  • Sample

    240715-lx8xxazhrn

  • MD5

    0028b642807c9e2140dc244e30e489e8

  • SHA1

    c9cc4100fb893d8573ea09ca1b65c2db12e293a8

  • SHA256

    b7178a09ec2b18d3ec02b0b7c746e27605bee55dc05969d67beb054c38f410b4

  • SHA512

    4af2b3e47c6d91ce9e692f212837a99bc46273638f6a8f6edc4a30f2a9048e1637cadaa53ab0f37d561bba04867261ae19cb75db64c5bf3ad13359ab49ea8968

  • SSDEEP

    98304:YnTmKmZl5qO4nVJCVJ5mFF5bVaP+q4WDi/6vnqAGLSj8hc7hw3lg8r/br:YnTmp5Sow5VRBWDpvnqAhR78lg8rj

Score
10/10
discordratevasionpersistenceratrootkitstealerthemidatrojan

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2MTcwMjM0NDQ4ODUyMTgwOQ.GItusX.BlaHBlSUZLcFqixVU_n9ThfF3DpKJGJou_LNIE

  • server_id

    1261770885514137682

Targets

    • Target

      b7178a09ec2b18d3ec02b0b7c746e27605bee55dc05969d67beb054c38f410b4

    • Size

      4.6MB

    • MD5

      0028b642807c9e2140dc244e30e489e8

    • SHA1

      c9cc4100fb893d8573ea09ca1b65c2db12e293a8

    • SHA256

      b7178a09ec2b18d3ec02b0b7c746e27605bee55dc05969d67beb054c38f410b4

    • SHA512

      4af2b3e47c6d91ce9e692f212837a99bc46273638f6a8f6edc4a30f2a9048e1637cadaa53ab0f37d561bba04867261ae19cb75db64c5bf3ad13359ab49ea8968

    • SSDEEP

      98304:YnTmKmZl5qO4nVJCVJ5mFF5bVaP+q4WDi/6vnqAGLSj8hc7hw3lg8r/br:YnTmp5Sow5VRBWDpvnqAhR78lg8rj

    Score
    10/10
    discordratevasionpersistenceratrootkitstealerthemidatrojan

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks