discordrat | f2a004514d969a0fd51adc95623168d8ea37c7a7eae79f8418fd369c35a33134 | Triage

Sharing

General

Target

release.zip
Size

445KB
Sample

240919-vab44ayglc
MD5

3d60e67d6e8740d413ee1574374609e1
SHA1

c65e926478a7fcae72d21f22ef3b9b16a61ca55c
SHA256

f2a004514d969a0fd51adc95623168d8ea37c7a7eae79f8418fd369c35a33134
SHA512

e43460aa06355e582c6b10fb1979d0b0d1ff96693912954f8b7fe03eb6839a3af03d1d467268bf76c20a8284b79f9c84590bdf542625e813d1a9cfac04aecde2
SSDEEP

12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQt:BKGo8EifSQwYWt

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Targets

- Target
  
  release.zip
- Size
  
  445KB
- MD5
  
  3d60e67d6e8740d413ee1574374609e1
- SHA1
  
  c65e926478a7fcae72d21f22ef3b9b16a61ca55c
- SHA256
  
  f2a004514d969a0fd51adc95623168d8ea37c7a7eae79f8418fd369c35a33134
- SHA512
  
  e43460aa06355e582c6b10fb1979d0b0d1ff96693912954f8b7fe03eb6839a3af03d1d467268bf76c20a8284b79f9c84590bdf542625e813d1a9cfac04aecde2
- SSDEEP
  
  12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQt:BKGo8EifSQwYWt
Score

10^/10

discordrat discovery persistence rat rootkit stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1
- Target
  
  Release/Discord rat.exe
- Size
  
  79KB
- MD5
  
  d13905e018eb965ded2e28ba0ab257b5
- SHA1
  
  6d7fe69566fddc69b33d698591c9a2c70d834858
- SHA256
  
  2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
- SHA512
  
  b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
- SSDEEP
  
  1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Score

10^/10

discordrat persistence rat rootkit stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
behavioral2
- Target
  
  builder.exe
- Size
  
  10KB
- MD5
  
  4f04f0e1ff050abf6f1696be1e8bb039
- SHA1
  
  bebf3088fff4595bfb53aea6af11741946bbd9ce
- SHA256
  
  ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
- SHA512
  
  94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
- SSDEEP
  
  96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
Score

3^/10

discovery
behavioral3
- Target
  
  dnlib.dll
- Size
  
  1.1MB
- MD5
  
  508ccde8bc7003696f32af7054ca3d97
- SHA1
  
  1f6a0303c5ae5dc95853ec92fd8b979683c3f356
- SHA256
  
  4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
- SHA512
  
  92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
- SSDEEP
  
  24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
Score

1^/10
behavioral4
- Target
  
  token.txt
- Size
  
  95B
- MD5
  
  ccf567d6f7cddda5ca716ce09c0c83be
- SHA1
  
  fd4601aacc2cafa14d67f38a93d52badf0b391c3
- SHA256
  
  b138f5fa47b8c66511e4f9293c04c370a1b8ea6d596adb6cbc13b8e29918bbec
- SHA512
  
  f52ab05b1cd3744cd40f4d62fe3775d8afca39f46228aa410a800742a268a575d2c2ceff47f20e2a0d5080b54d3c67b657c320a840a390063c81713f5ada4066
Score

1^/10
behavioral5

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discordratdiscoverypersistenceratrootkitstealer

behavioral2

discordratpersistenceratrootkitstealer

behavioral3

behavioral4

behavioral5