discordrat | fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 464KB
Sample260717-l2tnsact21
SHA256 fb16150e272e5a3ea8cabf349c5fed54bc62002784e43f747ae649d4fb9ccfae
MD5 6f3ab8676376a1148e31a9e1e1fca36b
SHA1 e7a46ca3857dc34e8cc95f6c07eead03c47ed5c9
SHA512 bcdc3de053b6d0dd0622a2b8db0dfea5de1cd988d2557f033dbd8ad39c2bfec8adc58cb3a5d37febddabf5c8e9d14d2f68dee663613dfb97c373a8fb756a28a6
SSDEEP 6144:aae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH9lSIw7G:CmiMZvN43+u85Bpw+YMRkc9TgIw7G
TLSH
T118A47D19D7F405FDE1B7E578CD934902EB76784907B1E68F03A499A61F232A08D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUyNzE1MDgyMTk0NTYzOTAxNQ.Gfu_97.Py6-_X6MonQRpvUYi5khLoc8KpaI6YuGw-CQnE
server_id
1527151478639427594

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024564-6.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral1/memory/872-14-0x0000019F2CB20000-0x0000019F2CB38000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Executes dropped EXE 1 IoCs

pid	Process
872	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	Client-built.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 872	2544	2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_6f3ab8676376a1148e31a9e1e1fca36b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
Size 78KB
SHA256 543892455a5b101b389ad394dda00fc46a5e0cf1eac582f7df4d2d271073d25c
MD5 a14381acf9c197d685ee16857c0a3043
SHA1 089002636ccfe860ad5e520941b0ba1ac4af02e9
SHA512 83659392d8fd6a7f68a6138b374a9190936a877d39ed55c11524a0e4eed3f2330caa00bee921cbe89e03568af1e483e102d23afa2b17e1120d4accfe4d8e5ef0
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC
TLSH
T1BE73C8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH