Overview

overview

10

Static

static

3

Nitropicsgpj.exe

windows7-x64

10

Nitropicsgpj.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nitropicsgpj.exe
  • Size 465KB
  • Sample241210-dzfedaxlam
  • SHA256 09c5a6d42c50ec674dc6deacdf2e0a3d2767ea36a6b57f0f4dd70fe8aab84b66
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discordratdiscoverypersistenceratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTMxNTg2OTM0MzczMjQ2NTY5NA.GkK745.9MtESkOseU77lQKPBYHDluyVKPE-w0i6qkwHOo

  • server_id

    1315868996016275477

Targets

    • Target
      Nitropicsgpj.exe
    • Size 465KB
    • SHA256 09c5a6d42c50ec674dc6deacdf2e0a3d2767ea36a6b57f0f4dd70fe8aab84b66
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discordratdiscoverypersistenceratrootkitstealer

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Discordrat family

      discordrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks