discordrat | cfd9da2ff11bd55e76125eebf234042c5a06b8743a93717b820622849a2f7038 | Triage

Sharing

General

Target

Client-built.exe
Size

78KB
Sample

241219-fd3c5aynfz
MD5

de442b92fcc6b8a28cd1983f68888dc3
SHA1

10066ba190b0b876fe9d39ea20f67b0c849a1d2f
SHA256

cfd9da2ff11bd55e76125eebf234042c5a06b8743a93717b820622849a2f7038
SHA512

e441f634a8128adb800ce56914750b1a4ff9a80fcd51960cfec5fa5e5262855c763decb4e9cef0aa19282ebceb4dad387b702f8be6a2228e004fca0fa6b91873
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

discordrat defense_evasion discovery persistence privilege_escalation rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxOTEwMTg1NDkxOTAzNjk2MA.GCUf3G.XFcTpUzToj5RvHJaCwYlInhFElu5QcrOsBscOE
server_id
1319102558568058921

Targets

- Target
  
  Client-built.exe
- Size
  
  78KB
- MD5
  
  de442b92fcc6b8a28cd1983f68888dc3
- SHA1
  
  10066ba190b0b876fe9d39ea20f67b0c849a1d2f
- SHA256
  
  cfd9da2ff11bd55e76125eebf234042c5a06b8743a93717b820622849a2f7038
- SHA512
  
  e441f634a8128adb800ce56914750b1a4ff9a80fcd51960cfec5fa5e5262855c763decb4e9cef0aa19282ebceb4dad387b702f8be6a2228e004fca0fa6b91873
- SSDEEP
  
  1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC
Score

10^/10

discordrat defense_evasion discovery persistence privilege_escalation rat rootkit spyware stealer
- Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Discordrat family
  discordrat
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Abuse Elevation Control Mechanism: Bypass User Account Control
  UAC Bypass Attempt via SilentCleanup Task.
  defense_evasion privilege_escalation
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discordratdefense_evasiondiscoverypersistenceprivilege_escalationratrootkitspywarestealer