Overview

overview

10

Static

static

10

mta.exe

windows7-x64

10

mta.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mta.exe

  • Size

    98KB

  • Sample

    241212-xgb4satkax

  • MD5

    778dce14368e8b1105544c43ce09d2f1

  • SHA1

    81c7cc17d48b8c5e6e5b9cc1efc8bbae1646dcb0

  • SHA256

    1d184c635a032625f10639ec3458a6f8d0a36a6a82078a11b820924f39056080

  • SHA512

    31a517a024726bef90c60c05173852de117e27960e981ec92456e6a3e4c0b6ac50437b8bfd2ced7afbad2a81c3e00a4c9bd5622af2236f3ae37856d6fd9d4aab

  • SSDEEP

    1536:Vic45PApy/vpjAnT9ZqzY4r5VVZDAcE3VCQfwbJ6Pr5+NzxCxoKV6+UyNV:AxApgR8T9EE4r5n8rwbJ6Pr5+zNyj

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Targets

    • Target

      mta.exe

    • Size

      98KB

    • MD5

      778dce14368e8b1105544c43ce09d2f1

    • SHA1

      81c7cc17d48b8c5e6e5b9cc1efc8bbae1646dcb0

    • SHA256

      1d184c635a032625f10639ec3458a6f8d0a36a6a82078a11b820924f39056080

    • SHA512

      31a517a024726bef90c60c05173852de117e27960e981ec92456e6a3e4c0b6ac50437b8bfd2ced7afbad2a81c3e00a4c9bd5622af2236f3ae37856d6fd9d4aab

    • SSDEEP

      1536:Vic45PApy/vpjAnT9ZqzY4r5VVZDAcE3VCQfwbJ6Pr5+NzxCxoKV6+UyNV:AxApgR8T9EE4r5n8rwbJ6Pr5+zNyj

    Score
    10/10
    discordratpersistenceratrootkitstealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Discordrat family

      discordrat

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks