Overview

overview

10

Static

static

3

2026-07-07...lc.exe

windows10-2004-x64

10

2026-07-07...lc.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-07_18a1e5981b42ee394b67d5c4ff0cdd0f_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
  • Size 722KB
  • Sample260707-mx69radt9l
  • SHA256 64b5d381a41fb608a9357ac6f6c568f03680819c94c40bc4336bc39362e62c64
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTUyMDM5MDkyMDA0MDg3Mzk4NA.GhC9Ne.fwUW-JjIFXq9qB9bQSreffyqWKWR4XlGmQ31NU

  • server_id

    1520391791743074375

Targets

    • Target
      2026-07-07_18a1e5981b42ee394b67d5c4ff0cdd0f_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
    • Size 722KB
    • SHA256 64b5d381a41fb608a9357ac6f6c568f03680819c94c40bc4336bc39362e62c64
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discordratpersistenceratrootkitstealer

    • Family: Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat
    • Custom signature

      Detects executables containing URLs to raw contents of a Github gist

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks