discordrat | Setup[.]exe | Triage

Sharing

General

Target

Setup.exe
Size

78KB
MD5

5fda4d494f49e20eb8acae03246baf84
SHA1

2d33d1a237e996f574a4fd28a2b7577e8c5db8bb
SHA256

af337e91f30e84ec4d0d45f477c04bd863f5244a5ec574dafb7d0c52f06312f4
SHA512

12b6d70de0cfe05690fa3533f79a776712c76b4af93e2d3a9be89095058aa351ea784cac59007cb3b21770b6a3e972f54555ec002f93c24e31386a6924fe968e
SSDEEP

1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+YPIC:KZb5PDwbjNrmAE+8IC

Score

10^/10

discordrat

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
https://discord.com/api/webhooks/1290318089715453992/Q4khFBrREPnThbBiwoJiXoxWwILml3iG2hTD1iRZh8Hps1c9KaPPWLdXwfX0C2XprkqB
server_id
1212805025588445215

Signatures

Discordrat family
discordrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Setup.exe

Files

Setup.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ