dnlib.zip
- SHA256 3b145171ad5c03f113a4d44eaae4406ef098c0436cc2b6df5523c0e1b2963de2
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/Discord rat.exe
Resource
win11-20240802-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
builder.exe
Resource
win11-20240802-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
dnlib.dll
Resource
win11-20240802-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target dnlib.zip
- Size 476KB
- Sample240909-145w6avdnb
- SHA256 3b145171ad5c03f113a4d44eaae4406ef098c0436cc2b6df5523c0e1b2963de2
- MD5 95577e04faffbbe124597197e7e873ec
- SHA1 8e8e18a9f658ff54de28843ff50f6b2d7c043c36
- SHA512 e2399094fdabd06571e421cc8f2941cd302d83eba42ef8d0de507d53b1a44a16410cba9cf8c735e07b360fd9dc6bc6771a517f98577dfca7cbb4b6c43913ec62
- SSDEEP 12288:AU4L0WXrwuuWzloW1njSZnCFALr0YqJtLrjjo:l4NXrZzzm2nj+MBtLbo
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTAzMzQ2NzA0MzgyOTI1NjIzMg.G4UNeh.nIwo45AlwhSb5yhADytdpXdiYF-i-GR3t_QATQ
-
server_id
1282683459751510101
Signatures
- Discordrat family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Client-built.exe unpack001/Release/Discord rat.exe unpack001/builder.exe unpack001/dnlib.dll
File Explorer
-
dnlib.zip.zip 476KB
-
Client-built.exe.exe 78KB
-
Release/Discord rat.exe.exe 79KB
-
builder.exe.exe 10KB
-
dnlib.dll.dll 1.1MB
Client-built.exe
- SHA256 92b83ad8a006dee0456660f365c23abed7ac6f56add63992fa212a58c366adf8
- MD5 363e07cdba8198a09ab5fc4d0aa6fa64
- SHA1 822faeacb2e1c74ead3d5dd595a23d3d4c0e3a21
- SHA512 b5febe41bd39ce7a9c42508222d299617330c53b95bb8c018958cc01ef736af589deff7709c2cf78c01b10e9bd6ea8a34db8f2116778da2c938c5c036f4efd10
- SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+DPIC:5Zv5PDwbjNrmAE+bIC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
76KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Release/Discord rat.exe
- SHA256 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
- MD5 d13905e018eb965ded2e28ba0ab257b5
- SHA1 6d7fe69566fddc69b33d698591c9a2c70d834858
- SHA512 b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
- SSDEEP 1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\maxim\Desktop\Discord rat c#\Discord rat\obj\Release\Discord rat.pdb
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
builder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
- MD5 4f04f0e1ff050abf6f1696be1e8bb039
- SHA1 bebf3088fff4595bfb53aea6af11741946bbd9ce
- SHA512 94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
- SSDEEP 96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\maxim\Desktop\Discord rat c#\builder\obj\Release\builder.pdb
mscoree
_CorExeMain
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
dnlib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- MD5 508ccde8bc7003696f32af7054ca3d97
- SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1167430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/src/obj/Release/net45/dnlib.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ