Analysis
-
max time kernel
427s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 04:03
General
-
Target
botter.exe
-
Size
78KB
-
MD5
8ebf44c3c47d368300e0d41c34296bf3
-
SHA1
fa5b7afe0f309a69344c52b0877be7fe35a35592
-
SHA256
2bd21a43c14023165182064239d919168353238b8e3027b72be4d47c5ec5c56c
-
SHA512
1b9d82a8b52ede86e79fb0cbf397036bca712d25777f26c243ed6aaa6a2c301011a12679d05ff79ad3a3944513cfa295922d4582f9de5daf86768d55465b0a68
-
SSDEEP
1536:1dK8EHG6SJNFrDCDopt4F4dhSc5Gr4ImshNzC/Eks0m0nbTdGFQngfo9wzWUbyVC:TK8EmBHpm0X40gUwhnzOspzyPCBf2hUv
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
4D544D794D7A51314E5451304D7A49784D6A677A4D6A67344D412E47777A4D35482E686E7467374B6B4A644C7A496F516D38395F4C62725575584F6B38692D5A694C31572D57624D
-
server_id
1327726809084854434
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\botter.exeC:\Users\Admin\AppData\Local\Temp\botter.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB