discordrat | c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

Resubmissions

12-12-2024 19:07

12-12-2024 19:07

11-12-2024 12:57

08-12-2024 12:52

08-12-2024 12:51

08-12-2024 12:48

max time kernel
436s
max time network
464s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11-12-2024 12:57

Target

Release/Discord rat.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	Discord rat.exe

C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

memory/4604-0-0x00007FFA209D3000-0x00007FFA209D5000-memory.dmp

Filesize
8KB

Download
memory/4604-1-0x0000015D4B150000-0x0000015D4B168000-memory.dmp

Filesize
96KB

Download
memory/4604-2-0x0000015D65800000-0x0000015D659C2000-memory.dmp

Filesize
1.8MB

Download
memory/4604-3-0x00007FFA209D0000-0x00007FFA21492000-memory.dmp

Filesize
10.8MB

Download
memory/4604-4-0x0000015D669A0000-0x0000015D66EC8000-memory.dmp

Filesize
5.2MB

Download
memory/4604-5-0x00007FFA209D3000-0x00007FFA209D5000-memory.dmp

Filesize
8KB

Download
memory/4604-6-0x00007FFA209D0000-0x00007FFA21492000-memory.dmp

Filesize
10.8MB

Download