Overview

overview

10

Static

static

3

BfIgOz7.exe

windows10-2004-x64

BfIgOz7.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    BfIgOz7.exe
  • Size 6.8MB
  • Sample240915-d7bfdstgnm
  • SHA256 73ffdb5bc29185f6c68ea22d571859218635a17bad466d4c5aee1b4a3421dfb1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discordratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTI4NDY3NDQ5OTc5ODc2NTczOA.GRsRSd.UW5uwQ1usFhHH7EewkpyCqw589sAshmfAmxuZg

  • server_id

    1284674413421133905

Targets

    • Target
      BfIgOz7.exe
    • Size 6.8MB
    • SHA256 73ffdb5bc29185f6c68ea22d571859218635a17bad466d4c5aee1b4a3421dfb1
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratdefense_evasionexecutionpersistenceprivilege_escalationratrootkitstealerdiscovery

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Command and Scripting Interpreter: PowerShell

      Start PowerShell.

      execution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks