discordrat | 28be5b432a2054fdb3e626c54eb20ee816d822e7b8bb6d3d31c73bf754e858ca

General

Target
2026-06-09_9bc257fe58d9d3e9ae3c897202eea457_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 502KB
Sample260609-ef9pjsbw8x
SHA256 28be5b432a2054fdb3e626c54eb20ee816d822e7b8bb6d3d31c73bf754e858ca
MD5 9bc257fe58d9d3e9ae3c897202eea457
SHA1 03929f9483003285ebf801ebc911ebcc6cb3bea0
SHA512 592061d565ca9255f6399639c7c5c82e9090ad235ab62a6b46fb4afd925b1f0d8027ae7f9fc20b27c18c9c2846615e6de7679ecfa0d588435ffcfdfc8f839e11
SSDEEP 12288:sRZeGAfqNGA3Uq29XIDixjpyq0Bd9pFCeJl:sRSfrAEH9XIYpj0Bd9fC0
TLSH
T11AB48D19E7E404FDE0B7E578CE934912E776B8494771E6CF03A499A61F232908E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTQ5MzM5MzAzNTk3NzgxODIzMg.G0a-1u.e9YSsbN7QUPEShHtVgKtwrPQo9W1cOQyAb-yoE
server_id
1494554299361919078

Targets

- Target
  2026-06-09_9bc257fe58d9d3e9ae3c897202eea457_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 502KB
- SHA256 28be5b432a2054fdb3e626c54eb20ee816d822e7b8bb6d3d31c73bf754e858ca
- MD5 9bc257fe58d9d3e9ae3c897202eea457
- SHA1 03929f9483003285ebf801ebc911ebcc6cb3bea0
- SHA512 592061d565ca9255f6399639c7c5c82e9090ad235ab62a6b46fb4afd925b1f0d8027ae7f9fc20b27c18c9c2846615e6de7679ecfa0d588435ffcfdfc8f839e11
- SSDEEP 12288:sRZeGAfqNGA3Uq29XIDixjpyq0Bd9pFCeJl:sRSfrAEH9XIYpj0Bd9fC0
- TLSH
  T11AB48D19E7E404FDE0B7E578CE934912E776B8494771E6CF03A499A61F232908E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2