Overview

overview

10

Static

static

3

11.exe

windows10-2004-x64

10

11.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    11.exe
  • Size 164KB
  • Sample260727-h3cvwaxyev
  • SHA256 d92cabc30a30e7b12445728d0400df31ea218dae71a850885b7eeabe53824938
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discordratdonutloaderdefense_evasionexecutionloaderpersistenceratrootkitstealer

Malware Config

Extracted

Family

  • discordrat

Attributes
  • discord_token

    MTUzMDI5NTIxNjAzOTM5OTU5NQ.GwMM-r.NMEkI60b8DUaG-7QdEn49z88kKc4a-kQ_8fPmc

  • server_id

    1530295517710651412

Targets

    • Target
      11.exe
    • Size 164KB
    • SHA256 d92cabc30a30e7b12445728d0400df31ea218dae71a850885b7eeabe53824938
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutiondiscordratdonutloaderloaderpersistenceratrootkitstealer

    • Detects DonutLoader

      loader

    • Family: Discord RAT

      A RAT written in C# using Discord as a C2.

      stealerrootkitratpersistencediscordrat

    • Family: DonutLoader

      DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

      loaderdonutloader

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks