Testing (4).zip
- SHA256 28d0e507702ae894ef549d90e981d965e73dddb9ae0f80ce607a60f5beab1d6f
Behavioral task
behavioral1
Sample
Testing (4).zip
Resource
win11-20241007-en
windows11-21h2-x64
49 signatures
300 seconds
General
- Target Testing (4).zip
- Size 5.9MB
- Sample241124-cdg6eatrdk
- SHA256 28d0e507702ae894ef549d90e981d965e73dddb9ae0f80ce607a60f5beab1d6f
- MD5 695d4ce0d09b895d3bcb76f12dbc8500
- SHA1 10ab3ecfacec5bbef521a1fb2dbe7cb8d4543db2
- SHA512 75bce4480d136e61b3bde3d2a07995f9a528f5217e5ef10655b394f457e563df00730ffac592648dd945b75aebd024318c8afa11a4071c899c79b1a4a16264db
- SSDEEP 98304:VYhsAjqphjdMXv8Xg1qdPNGWI833edIVEXYxssdOTyc4Fh+LhwgLUpjbk387dYu6:qsAW7jakwUGbE3edIqB2c4FIhwg6/y6M
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTMwOTg3NTA0MzA1MTg5Njk1NA.GTR-3U.C7tazMXoRaSR--tVDMbQdoDKBw2f8bLXItZIRo
-
server_id
1309876526615101530
Signatures
- Discordrat family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe unpack001/Discordrat.exe unpack001/F4620C0AFA8E21897509B2E7215097F5.exe unpack001/unturnedHack.exe
File Explorer
-
Testing (4).zip.zip 5.9MB
-
94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe.exe 1.8MB
-
Discordrat.exe.exe 90KB
-
F4620C0AFA8E21897509B2E7215097F5.exe.exe 2.1MB
-
unturnedHack.exe.exe 4.1MB
94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7
- MD5 f42590bc6a794fb1d34aba733035bc5e
- SHA1 d3ffb11f07d68b79d7c6d7aeab5571722a603d1c
- SHA512 40e1f2367a57f1bfc7cff43d496dcca4419b2324099c8a835561f372a34b3a2eba82033aba337e20f70c7e142fee6a1ecf26ccea122bfc7191aa50d7a0b05064
- SSDEEP 49152:m0u8PuIv8ZuAD/juxrb3LJQ8gUGza+7X0LSH71XXZ1:u8PYDkH7GRz14LSH7dZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4972544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
182KB
Virtual Size
432KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
nvhpawoq
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
mkywopfk
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.taggant
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=13, id=259, version=27412,
count=186, id=261, version=27412,
count=18, id=260, version=30034,
count=22, id=259, version=30034,
count=89, id=261, version=30034,
count=2, id=253, version=23601,
count=23, id=260, version=27412,
count=19, id=257, version=27412,
count=243, id=1, productName=Unmarked objects,
count=1, id=265, version=30156,
count=1, id=255, version=30156,
count=1, id=258, version=30156,
Discordrat.exe
- SHA256 1f3b8599d811004b6d52d543e451555944c3c4dc2893d04a370a0874e99c82af
- MD5 d74728a955861daf303ff42c7f572d16
- SHA1 a73b4d871a4caec1700349de9b5f7dbf4ba59f7b
- SHA512 73c271de7061e53b91079636d99f1967ce922bf47c14539569b2f0f3a9b6628bc4cc1fd9a7d7cb1e10bdfc95c8ce49e0a0f3a815cf5810f44a5c2b35ba116e69
- SSDEEP 1536:ibPjt72uOFmYskRPUAqtBTldwX0bpAkAfLgbGNrk+uexCxoKV6+fEX85:EjtyuOFpskpgBTlukQgbGNrk+bSEXQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\EnderPearl\Downloads\Discord-RAT-2.0-master\Discord-RAT-2.0-master\Discord rat\obj\Debug\Discord rat.pdb
Name
.text
Size
88KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
F4620C0AFA8E21897509B2E7215097F5.exe
- IMPHASH 12e12319f1029ec4f8fcbed7e82df162
- SHA256 8daf7dcdf256d7de40d33e5550dc5e8bbf887b8c4b7f49c79a15c96dad867f82
- MD5 f4620c0afa8e21897509b2e7215097f5
- SHA1 af216ca6105e271a3fb45a23c10ee7cf3158b7e1
- SHA512 68b875acc06d9c3796f49377b5b25a5e8b9a380221eea59e4274249ca7d2bff10c3fc5edf50eae5da726afea882e0e777af86af25be7b57c8fbfd70448d8d7dd
- SSDEEP 49152:IBJz3c6UY0hj8eu32ILwfhNE5I6OrLCXLdsN6:yh3cvY0Z8pGWwfhyxOrUsN6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
128304
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
kernel32
GetLastError
SetLastError
FormatMessageW
GetCurrentProcess
DeviceIoControl
SetFileTime
CloseHandle
CreateDirectoryW
RemoveDirectoryW
CreateFileW
DeleteFileW
CreateHardLinkW
GetShortPathNameW
GetLongPathNameW
MoveFileW
GetFileType
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
SetFileAttributesW
GetFileAttributesW
FindClose
FindFirstFileW
FindNextFileW
InterlockedDecrement
GetVersionExW
GetCurrentDirectoryW
GetFullPathNameW
FoldStringW
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FreeLibrary
GetProcAddress
GetCurrentProcessId
ExitProcess
SetThreadExecutionState
Sleep
LoadLibraryW
GetSystemDirectoryW
CompareStringW
AllocConsole
FreeConsole
AttachConsole
WriteConsoleW
GetProcessAffinityMask
CreateThread
SetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
ResetEvent
ReleaseSemaphore
WaitForSingleObject
CreateEventW
CreateSemaphoreW
GetSystemTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCPInfo
IsDBCSLeadByte
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
GlobalFree
LoadResource
SizeofResource
SetCurrentDirectoryW
GetExitCodeProcess
GetLocalTime
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
MoveFileExW
GetLocaleInfoW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
DecodePointer
SetFilePointerEx
GetConsoleMode
GetConsoleCP
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
LocalFree
RtlUnwind
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
QueryPerformanceFrequency
GetModuleHandleExW
GetModuleFileNameA
GetACP
HeapFree
HeapAlloc
HeapReAlloc
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
oleaut32
SysAllocString
SysFreeString
VariantClear
gdiplus
GdipAlloc
GdipDisposeImage
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateBitmapFromStreamICM
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipFree
Name
.text
Size
199KB
Virtual Size
198KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
400B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=241, version=40116,
count=142, id=243, version=40116,
count=24, id=242, version=40116,
count=2, id=253, version=30625,
count=19, id=260, version=30625,
count=23, id=259, version=30625,
count=52, id=261, version=30625,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=277, id=1, productName=Unmarked objects,
count=49, id=261, version=30709,
count=1, id=256, version=30709,
count=1, id=255, version=30709,
count=1, id=258, version=30709,
unturnedHack.exe
- IMPHASH ce5eab935d79deb808c783e73ea12cf9
- SHA256 4531a1efd815df17d3a6f247d0850ab5e510de2345723e41c062716e65df686e
- MD5 c5293ff604e4231fdffaa092fd7c5ca8
- SHA1 9e8aeb9ec19b8a6d534360883188872a257bb337
- SHA512 57a64316ac3944a4050853f491b85b373fc9e5f393c868d20243fcf1dfda4e733a61cf0348b7e0be25e7b880e49373131c500b5f91e7eb0c345957e070ad5fc9
- SSDEEP 49152:Xl4UjB0jUudKphZByreh+Woao/OZa8XLh+4vBTVlz8svA:14UjKgu8A
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
327120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetRawInputDeviceInfoW
GetRawInputDeviceList
kernel32
AcquireSRWLockExclusive
AreFileApisANSI
CloseHandle
CreateFileMappingW
CreateFileW
CreateProcessA
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetLastError
GetLocaleInfoEx
GetLocaleInfoW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetUserDefaultLCID
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameW
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExW
LocalFree
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
RaiseException
ReadConsoleW
ReadFile
ReadProcessMemory
ReleaseSRWLockExclusive
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetThreadContext
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualAllocEx
VirtualFree
VirtualProtect
VirtualQuery
VirtualQueryEx
WideCharToMultiByte
WriteConsoleW
WriteFile
WriteProcessMemory
mpr
WNetCloseEnum
WNetEnumResourceA
WNetOpenEnumA
Name
.text
Size
484KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
424B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ