Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows11-21h2-x64

10

Resubmissions

16/04/2026, 14:56

260416-sa4s1aex7s4

15/04/2026, 11:55

260415-n3traac16m10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://cdn.discordapp.com/attachments/1493942672132411432/1493942767573926060/slde4von_x_irox.exe?ex=69e0ce1f&is=69df7c9f&hm=53c58d01098dcf42c0729f6ba826bf8f53850617fc221824d722266800edabf7&
  • Sample260415-n3traac16m
Score
10/10
discordratdefense_evasiondiscoverypersistenceratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTQ5MzkyOTUwMDQ4Mjg2MzI1NA.G21Dgb.-pL-Wi6cOhOXr1bDCBu2X0ZRcQ9adMUsj3KefA

  • server_id

    1493930179612119112

Targets

    • Target
      https://cdn.discordapp.com/attachments/1493942672132411432/1493942767573926060/slde4von_x_irox.exe?ex=69e0ce1f&is=69df7c9f&hm=53c58d01098dcf42c0729f6ba826bf8f53850617fc221824d722266800edabf7&
    Score
    10/10
    defense_evasiondiscoverydiscordratpersistenceratrootkitstealer

    • Family: Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks