discordrat | ff2ea61c51ae7ad2b73dfd033d04ab0826b938ded03f199bd332b14def6bdef1

General

Target
xff2ea61c51ae7ad2b73dfd033d04ab0826b938ded03f199bd332b14def6bdef1.exe
Size 568KB
Sample260710-vsn7dadt3j
SHA256 ff2ea61c51ae7ad2b73dfd033d04ab0826b938ded03f199bd332b14def6bdef1
MD5 db823d4d662712b2d95d57f5fa373ab7
SHA1 d83d823d8f7f7fb3249d3f16bc03b630279e083d
SHA512 268c037beeb45840f8cbc979a32431a5b04912e312b9a34d18dba50a38228a1f7f03752cb3fb3ef73e1a3ffd73f148d45c4f5652cd9a1ea59fb6c25f8ae6f4d5
SSDEEP 12288:XRZeGAfqNGA3Uq29XIDixjpyq0BPn+u82Ldmd4jy:XRSfrAEH9XIYpj0BPn+uRLdigy
TLSH
T130C49E19E7E405FDE1B7E578CE834902E776B8091761E7CF03A499A21F272909E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyNDc2OTI5MjQ1MTcwOTA1OA.GF3Jmw.uH9O3VmYJwrPUYGI-IWYNeOlCdt2c8UdE-Bv4I
server_id
1504840416913129542

Targets

- Target
  xff2ea61c51ae7ad2b73dfd033d04ab0826b938ded03f199bd332b14def6bdef1.exe
- Size 568KB
- SHA256 ff2ea61c51ae7ad2b73dfd033d04ab0826b938ded03f199bd332b14def6bdef1
- MD5 db823d4d662712b2d95d57f5fa373ab7
- SHA1 d83d823d8f7f7fb3249d3f16bc03b630279e083d
- SHA512 268c037beeb45840f8cbc979a32431a5b04912e312b9a34d18dba50a38228a1f7f03752cb3fb3ef73e1a3ffd73f148d45c4f5652cd9a1ea59fb6c25f8ae6f4d5
- SSDEEP 12288:XRZeGAfqNGA3Uq29XIDixjpyq0BPn+u82Ldmd4jy:XRSfrAEH9XIYpj0BPn+uRLdigy
- TLSH
  T130C49E19E7E405FDE1B7E578CE834902E776B8091761E7CF03A499A21F272909E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2