Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/09/2024, 16:12
240928-tnypksxdjb 1022/09/2024, 12:56
240922-p6n6ms1bnh 1020/09/2024, 19:36
240920-ybrgysthjq 10Analysis
-
max time kernel
2s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/09/2024, 12:56
Behavioral task
behavioral1
Sample
DiscordHackerTools.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
DiscordHackerTools.exe
Resource
win10v2004-20240802-en
General
-
Target
DiscordHackerTools.exe
-
Size
90KB
-
MD5
fdd2dbdc384cfcedf86537203b6ed986
-
SHA1
37f7f2ccc0f594445ccc1b846da2cf7885dfea6d
-
SHA256
95e5f46c36b28533bbf92f1a264dcc439aea1b0e030e360998e830b5b7036edf
-
SHA512
161d6524e73891b719c28b29e95734f30ace6e93771164faed3bdab689e59ef641e5645ee5c5d458518b5200f865dcc62ab4336b2f899bbcaef79cced0c6538c
-
SSDEEP
1536:sbPjt72uOFmYskRPUAqtBTldwr0bpAkA/rZgbGNra+uexCxoKV6+f2vH:ajtyuOFpskpgBTlugmgbGNra+bS2P
Malware Config
Extracted
discordrat
-
discord_token
MTI4NjY5NzM2MzA0OTY3NjgyMg.GXVoQY.9z4vKuRhM26WGS-YJsP0Qdv7XSkZ1mvw0jZ_4w
-
server_id
1286696321482489930
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2328 wrote to memory of 3020 2328 DiscordHackerTools.exe 31 PID 2328 wrote to memory of 3020 2328 DiscordHackerTools.exe 31 PID 2328 wrote to memory of 3020 2328 DiscordHackerTools.exe 31