Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 17:29
General
-
Target
Spoffer.exe
-
Size
78KB
-
MD5
b3e26af2b5a30b898598ff249775f57d
-
SHA1
222b453cdfee930e62ce99cd3b959c10911d4f24
-
SHA256
3b46e7f9db47c338590d7934145579799c2ed82e4ec4ca33de8cd00d42fc4a1e
-
SHA512
a1e0bb3bfa391075f173a483f902ce5abf6f50ce9e17a5ec686f06787ef0c808163f586024c5e4137995b50b5227b647c63e68a7edcdb0f05d8a8b2d62d28c42
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5MzkzNjk4NDE3NTI4NDIyNQ.GHVwqc.oVE-laJFGZqCBjLAbY3CY7gEr1zASuiKNJ_rAE
-
server_id
1293938026614886441
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoffer.exe"C:\Users\Admin\AppData\Local\Temp\Spoffer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB