discordrat | 85ba25c57ea8bfcad5cc5b0e9833a1a4a386ea78a80681c86ee30976c3e22095

General

Target
2026-08-01_30b1d665ec0cb170f76a652b95a26941_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 736KB
Sample260802-exalsadj8y
SHA256 85ba25c57ea8bfcad5cc5b0e9833a1a4a386ea78a80681c86ee30976c3e22095
MD5 30b1d665ec0cb170f76a652b95a26941
SHA1 5379d8965e6a77b92f3c498251d8ead151798dc6
SHA512 c275e58209ba39c0825e4363d72d344cf8a71bd1ac2e1f3a3cf99e9edb0053fe243ec4694bc57c287969c157df51812ec11e25f37afa569e37ddab12429158d1
SSDEEP 12288:KciZ4qN4ZkKdcLtmUzG8GIJ9EDmfHJUEkBlh9Q8JU3Mb2NuabpLYmiOA:B25kkKdcLt08/9+mfpWBlk+2uab95A
TLSH
T1A3F4CF19D7F405FDE1B7E5B8CD934902EB76784947B1E6CF03A499A21F232908E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUzMjUwMjQzMzk0NTc0NzUwNw.G7tfhr.jGueZK41t-Rgx80SW7xCngfRHPQjXKbhAYHuv8
server_id
1532502332003188776

Targets

- Target
  2026-08-01_30b1d665ec0cb170f76a652b95a26941_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 736KB
- SHA256 85ba25c57ea8bfcad5cc5b0e9833a1a4a386ea78a80681c86ee30976c3e22095
- MD5 30b1d665ec0cb170f76a652b95a26941
- SHA1 5379d8965e6a77b92f3c498251d8ead151798dc6
- SHA512 c275e58209ba39c0825e4363d72d344cf8a71bd1ac2e1f3a3cf99e9edb0053fe243ec4694bc57c287969c157df51812ec11e25f37afa569e37ddab12429158d1
- SSDEEP 12288:KciZ4qN4ZkKdcLtmUzG8GIJ9EDmfHJUEkBlh9Q8JU3Mb2NuabpLYmiOA:B25kkKdcLt08/9+mfpWBlk+2uab95A
- TLSH
  T1A3F4CF19D7F405FDE1B7E5B8CD934902EB76784947B1E6CF03A499A21F232908E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2