discordrat | 94940d4797679ad5859cdb3a32148976dc39af147a481afc4e8ec499ef5b241a

General

Target
2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 486KB
Sample260701-j5chkaby8x
SHA256 94940d4797679ad5859cdb3a32148976dc39af147a481afc4e8ec499ef5b241a
MD5 9f6239a760cacd2dd1fe2ea73728edbf
SHA1 1d7bc9fce4987806247e5c506780557dba8a771f
SHA512 e0a5a965cbe07d07cc519579295e813314973236abfae7945147cbb87539f5d1742b616d4d5a63fe50d63da8045c683b282cd17db084974269abc65f60f4ea2c
SSDEEP 6144:xRs9Djkimq76tIy5qHbh4ZkcRKCfmJLaImb4zG8GR4e/1Q4gJOlOIwpwsK:2ciZ4qN4ZkKdcLtmUzG8G4e9EOUIoJK
TLSH
T17CB47D19E7F405F9E1B3E578CE934902EB7778490771E68F03AC59A61F236908E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTQ4MjUzMjc3MjU0NjQ4MjI5Nw.Gr4LRK.KTn5vocr3EKVPI7wJgzv2pMw2bdIQXEfs352Ro
server_id
1521227248722509844

Targets

- Target
  2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 486KB
- SHA256 94940d4797679ad5859cdb3a32148976dc39af147a481afc4e8ec499ef5b241a
- MD5 9f6239a760cacd2dd1fe2ea73728edbf
- SHA1 1d7bc9fce4987806247e5c506780557dba8a771f
- SHA512 e0a5a965cbe07d07cc519579295e813314973236abfae7945147cbb87539f5d1742b616d4d5a63fe50d63da8045c683b282cd17db084974269abc65f60f4ea2c
- SSDEEP 6144:xRs9Djkimq76tIy5qHbh4ZkcRKCfmJLaImb4zG8GR4e/1Q4gJOlOIwpwsK:2ciZ4qN4ZkKdcLtmUzG8G4e9EOUIoJK
- TLSH
  T17CB47D19E7F405F9E1B3E578CE934902EB7778490771E68F03AC59A61F236908E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2