discordrat | d9faa13bea96aa5342700b711d3ca59d77642fe4b063446664e56d6051a70775 | Triage

Sharing

General

Target

Solara_Bootstrapper.exe
Size

15.8MB
Sample

241011-fn643awfrc
MD5

e8de17aa7b8d041a42d3be4d9bb8b818
SHA1

27ef5d751b40d8c5e280638f3085676d08d36c8e
SHA256

d9faa13bea96aa5342700b711d3ca59d77642fe4b063446664e56d6051a70775
SHA512

2bad9ad4d974db98a0adc2bb0098b34a130ce2cb920d2c0977aaf37490ebb74f416b86018b4b1a6c2a8be7555376b76644fd77d8aadefbdffe2ce260437083b4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+3PIC:5Zv5PDwbjNrmAE+/IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI5MzY4MTEyNTMyMjkyMDAyMg.GHJfv9.tfuMP5Xy9zJB67D_6d0UpD39_ZIr6TqJf5Y6EM
server_id
1293975894108540940

Targets

- Target
  
  Solara_Bootstrapper.exe
- Size
  
  15.8MB
- MD5
  
  e8de17aa7b8d041a42d3be4d9bb8b818
- SHA1
  
  27ef5d751b40d8c5e280638f3085676d08d36c8e
- SHA256
  
  d9faa13bea96aa5342700b711d3ca59d77642fe4b063446664e56d6051a70775
- SHA512
  
  2bad9ad4d974db98a0adc2bb0098b34a130ce2cb920d2c0977aaf37490ebb74f416b86018b4b1a6c2a8be7555376b76644fd77d8aadefbdffe2ce260437083b4
- SSDEEP
  
  1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+3PIC:5Zv5PDwbjNrmAE+/IC
Score

10^/10

discordrat persistence rat rootkit stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discordratpersistenceratrootkitstealer

behavioral2

discordratpersistenceratrootkitstealer