discordrat | fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae

General

Target
2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 464KB
Sample260717-l2tnsact21
SHA256 fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae
MD5 6f3ab8676376a1148e31a9e1e1fca36b
SHA1 e7a46ca3857dc34e8cc95f6c07eead03c47ed5c9
SHA512 bcdc3de053b6d0dd0622a2b8db0dfea5de1cd988d2557f033dbd8ad39c2bfec8adc58cb3a5d37febddabf5c8e9d14d2f68dee663613dfb97c373a8fb756a28a6
SSDEEP 6144:aae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH9lSIw7G:CmiMZvN43+u85Bpw+YMRkc9TgIw7G
TLSH
T118A47D19D7F405FDE1B7E578CD934902EB76784907B1E68F03A499A61F232A08D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyNzE1MDgyMTk0NTYzOTAxNQ.Gfu_97.Py6-_X6MonQRpvUYi5khLoc8KpaI6YuGw-CQnE
server_id
1527151478639427594

Targets

- Target
  2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 464KB
- SHA256 fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae
- MD5 6f3ab8676376a1148e31a9e1e1fca36b
- SHA1 e7a46ca3857dc34e8cc95f6c07eead03c47ed5c9
- SHA512 bcdc3de053b6d0dd0622a2b8db0dfea5de1cd988d2557f033dbd8ad39c2bfec8adc58cb3a5d37febddabf5c8e9d14d2f68dee663613dfb97c373a8fb756a28a6
- SSDEEP 6144:aae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH9lSIw7G:CmiMZvN43+u85Bpw+YMRkc9TgIw7G
- TLSH
  T118A47D19D7F405FDE1B7E578CD934902EB76784907B1E68F03A499A61F232A08D3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2