General

  • Target

    Client-built.exe

  • Size

    78KB

  • Sample

    241224-xyvbpavkbv

  • MD5

    0752e168205a248479dd8b5e7e0098a0

  • SHA1

    63279851de2b0da579acb43fb097cad6af7247f8

  • SHA256

    183ed61135fcfc8c4c4063417cfb5a78b5a4d4249b3267795dfbc08f37e90da4

  • SHA512

    d1ec91ce7892b64d1cbc5feba5319df0720dff2902344078ed288649c501782e767e775b39b66d3db6c8cd59433f4307fef1b53e0c1748e0bc39a5f136386a40

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMyMDU5OTc3NTE3MDc4OTM5Ng.GWJ_0m.UNVuvmOJK5NOt5ChKmqbbDAwuVKFeUIbudMI94

  • server_id

    1321190565332652083

Targets

    • Target

      Client-built.exe

    • Size

      78KB

    • MD5

      0752e168205a248479dd8b5e7e0098a0

    • SHA1

      63279851de2b0da579acb43fb097cad6af7247f8

    • SHA256

      183ed61135fcfc8c4c4063417cfb5a78b5a4d4249b3267795dfbc08f37e90da4

    • SHA512

      d1ec91ce7892b64d1cbc5feba5319df0720dff2902344078ed288649c501782e767e775b39b66d3db6c8cd59433f4307fef1b53e0c1748e0bc39a5f136386a40

    • SSDEEP

      1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

    • Discord RAT

      A RAT written in C# using Discord as a C2.

    • Discordrat family

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks