discordrat | release[.]zip

Resubmissions

12/12/2024, 19:07

241212-xs6grswlhj10

12/12/2024, 19:07

11/12/2024, 12:57

08/12/2024, 12:52

08/12/2024, 12:51

08/12/2024, 12:48

Sharing

Copy URL Twitter E-mail

General

Target
release.zip
Size 445KB
Sample241208-p133lstpbw
SHA256 c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
MD5 06a4fcd5eb3a39d7f50a0709de9900db
SHA1 50d089e915f69313a5187569cda4e6dec2d55ca7
SHA512 75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
SSDEEP 12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discordrat

Malware Config

Signatures

Discordrat family
discordrat

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Release/Discord rat.exe
unpack001/builder.exe
unpack001/dnlib.dll

File Explorer

release.zip

.zip 445KB
Release/Discord rat.exe

.exe 79KB
builder.exe

.exe 10KB
dnlib.dll

.dll 1.1MB

release.zip

SHA256 c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
MD5 06a4fcd5eb3a39d7f50a0709de9900db
SHA1 50d089e915f69313a5187569cda4e6dec2d55ca7
SHA512 75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
SSDEEP 12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
MD5 SHA1 SHA512 SSDEEP

Release/Discord rat.exe

SHA256 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
MD5 d13905e018eb965ded2e28ba0ab257b5
SHA1 6d7fe69566fddc69b33d698591c9a2c70d834858
SHA512 b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP 1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\maxim\Desktop\Discord rat c#\Discord rat\obj\Release\Discord rat.pdb

builder.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
MD5 4f04f0e1ff050abf6f1696be1e8bb039
SHA1 bebf3088fff4595bfb53aea6af11741946bbd9ce
SHA512 94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
SSDEEP 96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\maxim\Desktop\Discord rat c#\builder\obj\Release\builder.pdb

dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
MD5 508ccde8bc7003696f32af7054ca3d97
SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1167430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

release.zip

Release/Discord rat.exe

generic

builder.exe

mscoree

dotnet

dnlib.dll

mscoree

dotnet