discordrat | 6bb20af93c141328edf4da9d1e531a11e3ba3205cf5ddb6be1c84eed2adf2721

Resubmissions

15/04/2025, 03:55

max time kernel
103s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2025, 03:55

Target

Client-built.exe
Size

78KB
MD5

841a0f704c61963a3befd3199a966db1
SHA1

378ed56be156f17265bc2fbd418737f24f61ca18
SHA256

6bb20af93c141328edf4da9d1e531a11e3ba3205cf5ddb6be1c84eed2adf2721
SHA512

30f56a9a74a4cc427afc8dff30a908f72f52b35b48b53c82182bc8f38af8587ef3d59af99961411f1f2edf856c37f3a2d48726f15e0f46bf85df5427922dd4c0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+3PIC:5Zv5PDwbjNrmAE+/IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTM0NDg0NTM0OTA1OTE3MDMwNA.GvAlnm.ylSBeBKEONTvSVab4ezuRLEHBm_55_uSWYoDYc
server_id
1361540227809673296

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2788	Client-built.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788

memory/2788-0-0x00007FFC300C3000-0x00007FFC300C5000-memory.dmp

Filesize
8KB

Download
memory/2788-1-0x000001D98AAB0000-0x000001D98AAC8000-memory.dmp

Filesize
96KB

Download
memory/2788-2-0x000001D9A50B0000-0x000001D9A5272000-memory.dmp

Filesize
1.8MB

Download
memory/2788-3-0x00007FFC300C0000-0x00007FFC30B81000-memory.dmp

Filesize
10.8MB

Download
memory/2788-4-0x000001D9A58B0000-0x000001D9A5DD8000-memory.dmp

Filesize
5.2MB

Download
memory/2788-5-0x00007FFC300C0000-0x00007FFC30B81000-memory.dmp

Filesize
10.8MB

Download