discordrat | 2180e15588a7ef82b71b0b63e7f93a46cd06c330b966e4a4ae858d20be0417ca

Sharing

Copy URL Twitter E-mail

General

Target
Walftech-Game-203160 (1).zip
Size 2.2MB
Sample260703-v5r4ssh19n
SHA256 2180e15588a7ef82b71b0b63e7f93a46cd06c330b966e4a4ae858d20be0417ca
MD5 1cdbfaa1416b28150cdf1b764a2ffb16
SHA1 a324c86ec72a90146aaa60cb4bd419e738c34ff3
SHA512 ed187040575e6365b66cc0196966c8f63e898b5654d575cdfe505bd278aa5d95d3396c9867d28c14a20f31c72d1212cc780dd746d9fcde7c35418979b1d8e454
SSDEEP 49152:mazmzKWPEdJdOvmRw5QO4Daq2KwbvhwrLAanyvkwHz:mazmzKWwRD56bvy/n9K
TLSH
T113B5335A5F6F48AAD50177F14673A288E83DB060CEDD2F2C3D0BE0F656960EDBD21A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyMjU2MDYzMDgyODA0MDI4NA.GmBkUW.ecf779_D_ZDKQUGurzto5zRlgHkXBWfyK7anis
server_id
1522539518136422510

Targets

- Target
  Walftech-Game-203160 (1).zip
- Size 2.2MB
- SHA256 2180e15588a7ef82b71b0b63e7f93a46cd06c330b966e4a4ae858d20be0417ca
- MD5 1cdbfaa1416b28150cdf1b764a2ffb16
- SHA1 a324c86ec72a90146aaa60cb4bd419e738c34ff3
- SHA512 ed187040575e6365b66cc0196966c8f63e898b5654d575cdfe505bd278aa5d95d3396c9867d28c14a20f31c72d1212cc780dd746d9fcde7c35418979b1d8e454
- SSDEEP 49152:mazmzKWPEdJdOvmRw5QO4Daq2KwbvhwrLAanyvkwHz:mazmzKWwRD56bvy/n9K
- TLSH
  T113B5335A5F6F48AAD50177F14673A288E83DB060CEDD2F2C3D0BE0F656960EDBD21A11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery discordrat persistence ransomware rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  203160.lua
- Size 8KB
- SHA256 a7bea5dfac9b25d9a4b6505705dbb8dff2bac6b4f6d88d95092f2632fc5cdd1d
- MD5 0deeaf87bdc1cde151670c5fdc8ec782
- SHA1 8075cc494b2413661c454e4c9414748fbe72afc5
- SHA512 123dee455a54d5e9a44d189b03de06f23a95d813d6123f1a4d3e63ab48b5a4cc8c15724ca1c0f4f6048ffe1cc1e6430d3501270d0935f6d8beb4199fe3172693
- SSDEEP 192:R9xBV8akSIH21XUoVgTePIbWUNXf/HleHxmVVmLMFB3gaEptzw4wrl5tZf0vt2z8:1BVbkSIHzoVIrXVC9PQPym8
- TLSH
  T1A702E0C21A3829147789ED0E281B5CAF3A5F909966CED0F7CD63FACD228A531DD20C1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3 behavioral4
- Target
  203161_6868169268668587009.manifest
- Size 390KB
- SHA256 cd121a1dc22c6ee355ec70aa9699a85302855fcb6a82c2c56343c33dc597c15b
- MD5 9e615f89726b3e677cd73ca21d526d68
- SHA1 706a655be98bc8cf931f77aae48e285c417a1df6
- SHA512 e579f6fa0afc6d87aeeefc0b5fc510594d79935adedd2c193efccaa6948bacaff6c4a399a6cb887e1d897ddcf4b7189d455742e3702ddfdb94cb67b2e25eb28a
- SSDEEP 12288:QeuJtArcN9BMmGo+pOuuIuhiMaV5Y17Y5X4svXONZhxh:5omETMmGoEqbEManYxsvXONZXh
- TLSH
  T1F88428153932E0F67288076B1858F61E8E222D316B4435D6EB5BC9624DDFE0327EFB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  203162_7173325336906608099.manifest
- Size 934B
- SHA256 d56af424258831c3298127a859004a8a8606fb6f17dbf5b0a0b3358dc8d62687
- MD5 888762448eefb00a33673e4064d0bbcb
- SHA1 c498ba0a9979d163fef454146b75ab7e09de6fe7
- SHA512 f00aa401cd05b6bde4fd984b17b6d7b6d5e8983c5b1559725f0d3d260a50a8aacdb6d44dfec1bbaf36fcebac4a52b3eacc5c039b407c73b5150729a3010fadfc
- TLSH
  T1ED1150A4303699C1A332437B9C8AFF0C8A19D63C0B6160EACE01352A4F64EA8218B650
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  203163_6372322314347314780.manifest
- Size 55KB
- SHA256 96e24e6258536990a6d47b943a3a077b381439a4d85b6e057f00d299a8c679b8
- MD5 895c0eb72eeb8ad71fec52c77c93a4b6
- SHA1 01e4879af23f923fcaf2b0daca51241c81c701f9
- SHA512 1dd39f057158e07e69cb314935448d495e31aca374530efc83c1e8f1d6bf15d5057ff0b528b0e2f8b5803b8ce7cfe276d84a4a6515d6fb44d838cb20439db4bd
- SSDEEP 1536:K7H34OVIv5cbSZNRRadGU3YYi7F2JUgGD:K7P+xvNRR+P3C7tD
- TLSH
  T1E6431704BE71A4DB725E422B5D4DEA1D8FD07F311B19B581CB9B8CAB0DAF942278B035
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral10 behavioral9
- Target
  203164_2221628542884248728.manifest
- Size 55KB
- SHA256 b60fc672fa115ce0b6b737f46867e0aff3da8c3b3d43c16d2adf86d121078923
- MD5 6c9d142da1db71dd69c06d8e23c3c754
- SHA1 3319e1aaa2d702eef9f47473c6b7c40e3252e118
- SHA512 070151fcd3cd0434cfc7695c366ddc59b203986f3819f973488024fa954a0a988c1e7427c60b39741a457c3ae1dd9335fbdbc50603aa60b85611945ef35395c7
- SSDEEP 768:5LvxiJ/HSvtxYc5WeqjbW1ZvPtC7QF8WmqJlCE744/ONCxSxxpaGFXjRCok7j/lK:1K/HWxx71Zv1CDWJJ+4/Oayx3nilNY
- TLSH
  T13843094829B1E4F3725D866F0C18EA5F4FB03E735B112191CF9AEE6A0D9F986539B034
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  203165_8032797791648544821.manifest
- Size 55KB
- SHA256 16c1b932d237e3efb8341ea75f2e1c1018ee159816cbdc187662896605f061fd
- MD5 be17a9468cce21ea8d76e09a658fe724
- SHA1 90bf187c7125d213059a93f1168f53491549529e
- SHA512 a207e9f2bbf736781b337695e5d2ce8738b9c2a44d60bb633dca016f395c4cccd1c57356eb025a71cc17bff3975c55e59d52611af670d734d84e0801b0359203
- SSDEEP 768:4E99M/K7+lLUkzt+CWt2/XgpPdeCPZvR//rwwe9T3WyylIY9EVxoKa7Ef2tK7hKT:AgqoC439deChvRkFlWyy39E0KUtK9tWd
- TLSH
  T19A431A44AB3168D7725E8E2B0C4FEA5F5F902E3147013599CB9AED6A8D9F90363DB031
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral13 behavioral14
- Target
  203166_6175707587917180945.manifest
- Size 55KB
- SHA256 de16eb46ceffc12968e96d1ad3d42ded20cb52600768448c38871ee4e58a9644
- MD5 630fd599655ae93d35fa4c48c0725027
- SHA1 bb3f7faa4373f8d11410e3f505974f9e7702e6df
- SHA512 dfa0d2f53232acfbb2b5fdb7979f5a1abcfc4898212ea81cadcd1f4087b06321dc52bf437574ba0aa44736f5a38bd83e814177165d636c3c4efc4f8278bac9a1
- SSDEEP 768:xmZH6rg8No6awvz2ODSqg+lsFq11GQduZbnZts5VGhWMWDwE0+Vye4rSp79fnyPU:cyoUCuSalStoeLE11L7KYKPzeN
- TLSH
  T1D94318086971E8F7725D429B084DE91F8FB03E7357143291CF9AEE6A0D9F986639B031
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  203167_3029664700874485048.manifest
- Size 55KB
- SHA256 d922fe22e51984cb45e0a21e80160c5e2de3af533ddda8552abf081ab9d201ef
- MD5 59686a8ddfb391cc455a27e26e7ea0b7
- SHA1 348ee31c7ffa554f3da80e1dcf62e961dd0baae9
- SHA512 8a8291dffcb77ca55d986342bf89981d6d2a46083d56ad4cab1b18d1fbcf00d1adb1054f8eab2ebcaea2a91677e903268d4f2708288f53869ea518716a82bfb8
- SSDEEP 1536:eWRTAjQyircfQcqNLhOUXmJvJDT+oW0cw:x9YduNwQQvJTK0cw
- TLSH
  T1AB431A446875A4D3726D036B2C48EA4CAFD03E3CEB0161C5CB5ABDEA0D9FE46639B435
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  203168_1651304722641604491.manifest
- Size 55KB
- SHA256 8335e7a25e067c345fdf30e0a305e39324fcb5ae9b03b424f123f7b0575892d5
- MD5 860f3e517a3ddf28f93b6a0092a9e1b2
- SHA1 ca06645346ba0db959615bb1569871eaa3ca228f
- SHA512 4f2a54c0e8d826403130d1c1e1c20ed73bfd8bbbff6cb4981a31a19e6de592379b0c1fdf6138ee55c3642506803b27d9e7ac08b2687897503e7467ff809d07ce
- SSDEEP 1536:50UhUpBBH8uDXBr3H08kPZkyL/S1wyNyA:5thUzBcMXhX08Ly74nN9
- TLSH
  T1EE43E4802935E7D73259022B4C1AEA3C8FB03A315B0265C9D69E8C7A4D9F9473BDB13D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19 behavioral20
- Target
  203169_4159211050702832863.manifest
- Size 55KB
- SHA256 5e3bc22f8a03c0c9724fd5b819f95c307de6a0006ff92f44afa212183f1becc5
- MD5 4e45388e26f8cd91fd46c1da5a7f33d0
- SHA1 39e184dc4375d9227095446ddbcc30f9312cc518
- SHA512 5f469f49df411487424084ae38a750aecf9ae1c8d7e7b506889477d359aaeb93ea0164a66e7a653506382837c238f96a3ddcbc2f8a5d6309c6cf4b8ba9429228
- SSDEEP 1536:aO3vqf7jeOP/QTNCusyETTVVKriTspm36qZ:aO3vsjuTDWTTKOQpZ4
- TLSH
  T1944309542971A4F7724D86AB1C1CDA1F9FF43EB31B1025A1CF9AED1A0C8F982279B531
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral21 behavioral22
- Target
  203170_7500082729520061352.manifest
- Size 55KB
- SHA256 f7ad80c4dc9adf15f2cff5583dd8df9cd2487c526af274215a995574cd17c9b8
- MD5 ab3dd2d0bd54c1a2de9db66fc7078de3
- SHA1 4250e882e15941a3e7ae051664a6efb2999fb7e8
- SHA512 84e6d4b87b409558b5ff64d52b1ffabdfd700c660f6ac047b7d6cb66300def2ae5036422ae7c78a17115dc444f0557bafae8b662722feaee64d5af4ec35ce485
- SSDEEP 768:jTtOI0QJcHjlhuOWLHoWwAPfRXulpnlKMfUKApIpvZy6bcimCEcKb8u8elgC/DuD:jTt9ahdMf/ItfUNIpvwViX4bD6C/iD
- TLSH
  T1CB43F7502939F0D3726D43278C4DFAAC9FA03A355B0166D8D69BDC6A0D9FE06639F132
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral23 behavioral24
- Target
  203171_308773064163359714.manifest
- Size 188B
- SHA256 65cb9ecc453b71960eef3fd4cf4fa5554f5d12f3448f66f4727ae404d8ee9c2b
- MD5 93c900c697806b086ff7397fc55f5410
- SHA1 106fa94fe26524f7de0bf50f7baa27835fa01bae
- SHA512 92a625af05862bd5ef955058ba90e29da835558357aff526fe2660ee9c04edfa4e16329ccae13e144cf4b946a42f6d78027149ecced29b4469a1879e5f3c67a4
- TLSH
  T1FDC022F06423258B08AC4A0A97300C4810E5C38BA6800E38600B89320A850044A5EEAF
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  203172_417401587203691460.manifest
- Size 188B
- SHA256 7443a63fd4900a254eaf40e08ccd67521a321f3dbae3cc43d828cba6631e8bee
- MD5 88b2ed71a248d28a9a06070a29f741e6
- SHA1 5827abb1c3f05973f00e7143994226d7914767b3
- SHA512 ea216bd7f1b77e3329ae2dd2ef74b44d4824917651a1261b4784c5444d1b4011a4a818b57c8d8c543121b38acb46dee99a70e88481b140a7e5a613ff2f37f65c
- TLSH
  T118C01241DA6505961AA9297CC80A490F21D66904C7E0A61F1A354571C47D0AA85D35F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  203173_126943139984375656.manifest
- Size 192B
- SHA256 3c143b49b94c133501199260cd90957e62dfc655cf4d73edc65ade9fa09d0c6e
- MD5 438fc3787c389b1630b92958ad31035a
- SHA1 7ca90169fb8ac7910207d7c6b3c0c5397a072c35
- SHA512 5a203f6f486ad898a7cbf9f2c0bbd378d8ed307f44708b17251dcf8268c652bc365b4e61de512790b38643f023782d83678989460d46282b1b5f76a67220b0b7
- TLSH
  T1F6C022EEBA112B0CF2761C180C8B0C0D106FC24F22E04BB6364C503349C403240B8004
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  203174_1498933388783282340.manifest
- Size 190B
- SHA256 e20f64181e5fada0fa3fe6267b848cb4655b57ca488863fb9b9c06e56e80f414
- MD5 29919d28e09afe681344b7f9de0286de
- SHA1 cbf7a8b139d44042f1aafb3b1676bd7626ed20c6
- SHA512 6bf4beecb96a41df15aefcd979e61294596516a1256aa2c76b98613e36c2f7c2d15e04ae102fcbc313e3478df548b95854255b8d322ae11034e234d34f8132f8
- TLSH
  T1D2C022C58AC90548D2AE8E04801F238F2E30EF8020354E12384F36306CE60D04A89004
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Contacts third-party web service commonly abused for C2

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32