Overview

overview

10

Static

static

10

Nuker.exe

windows10-2004-x64

10

Nuker.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Nuker.exe

  • Size

    78KB

  • Sample

    240718-vdq3es1bmd

  • MD5

    487cac43ec81f1851d895f7da7c2ed31

  • SHA1

    a57243fbbb3a3bbb68d8cc2c24665097d5e5937c

  • SHA256

    c9f5caa2963b2a6810f04b740a36dc68533711baf74ed5c2cc9e6ee7820d87a7

  • SHA512

    3333925e7869579b9c1bf9dfe1bc0a8caac6f62846c5ea53a0e916dbda43d7ebc0b73082c36199ade9ef10ace7d81dac591a7c50c17150d9af3924f2fdbb7d08

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC

Score
10/10
discordratpersistenceratrootkitspywarestealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2MTQ2MDc1NDk5ODEwMDA3OQ.GEglZz.6JqO9bf4CCcrev5NFz_m_RrqxOivTqTcbCsRg0

  • server_id

    1261792833887801445

Targets

    • Target

      Nuker.exe

    • Size

      78KB

    • MD5

      487cac43ec81f1851d895f7da7c2ed31

    • SHA1

      a57243fbbb3a3bbb68d8cc2c24665097d5e5937c

    • SHA256

      c9f5caa2963b2a6810f04b740a36dc68533711baf74ed5c2cc9e6ee7820d87a7

    • SHA512

      3333925e7869579b9c1bf9dfe1bc0a8caac6f62846c5ea53a0e916dbda43d7ebc0b73082c36199ade9ef10ace7d81dac591a7c50c17150d9af3924f2fdbb7d08

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC

    Score
    10/10
    discordratpersistenceratrootkitstealerspyware

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks