General

  • Target

    Client-built.exe

  • Size

    78KB

  • Sample

    240907-26b8as1alk

  • MD5

    11af10640463e381040c97f7453db3b5

  • SHA1

    f84ff02901fbeda22ad6d941819d5aed193f37da

  • SHA256

    a426b40512f00b3a895a1a9a7105aff8aaf9a065b63675f03bc9f3dad3b50852

  • SHA512

    27b91211f1788d3056c898d9073bcb15ee6a45d4e8a9add09349cb558b7068677f0c3bec89dce65226404e1a475c4052bb8372e87f3eacbfb7f2858e3fa04ce2

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI4MjEwOTQ5MDA4MjM1MzIyMw.GDmglk.P078HPfpQ_76MinLMBVkHQNQK2S6Yx6gekSNs8

  • server_id

    1282109732055683246

Targets

    • Target

      Client-built.exe

    • Size

      78KB

    • MD5

      11af10640463e381040c97f7453db3b5

    • SHA1

      f84ff02901fbeda22ad6d941819d5aed193f37da

    • SHA256

      a426b40512f00b3a895a1a9a7105aff8aaf9a065b63675f03bc9f3dad3b50852

    • SHA512

      27b91211f1788d3056c898d9073bcb15ee6a45d4e8a9add09349cb558b7068677f0c3bec89dce65226404e1a475c4052bb8372e87f3eacbfb7f2858e3fa04ce2

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC

    • Discord RAT

      A RAT written in C# using Discord as a C2.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks