discordrat | b528683ba398618eba9d1a14142f9cd8bc058f524a2269007378aa3a875f353e

General

Target
2026-08-04_828fe83189eccf46d551e1ffd1ab143b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 505KB
Sample260804-hbqmnaed94
SHA256 b528683ba398618eba9d1a14142f9cd8bc058f524a2269007378aa3a875f353e
MD5 828fe83189eccf46d551e1ffd1ab143b
SHA1 16ac4a264fc44b297419ea0b7ae37c957eab7f64
SHA512 cd210a0afd08d733da0bfcc9dada890e57baa434f4ddf0c4417877638f949c92623653fa36fd41a52324cfd7a80b0abb0e00cf4e711347796975713f77ca70eb
SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3l6ImpwsrnG/X+:qmiMZvN43+u85Bpw+YMRkc9B0ImJLsX+
TLSH
T14AB48D19D7E405FDE0B7E578CD934902EB767C4A4771E68F03A499A21F332A09D3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUzMzczNTkxMzA1Njc2ODEzMg.GyIjyR.XODAHNpLg1FE6LDY1JcZOBawfTc0HTvVYLXuAA
server_id
1533736436694519980

Targets

- Target
  2026-08-04_828fe83189eccf46d551e1ffd1ab143b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 505KB
- SHA256 b528683ba398618eba9d1a14142f9cd8bc058f524a2269007378aa3a875f353e
- MD5 828fe83189eccf46d551e1ffd1ab143b
- SHA1 16ac4a264fc44b297419ea0b7ae37c957eab7f64
- SHA512 cd210a0afd08d733da0bfcc9dada890e57baa434f4ddf0c4417877638f949c92623653fa36fd41a52324cfd7a80b0abb0e00cf4e711347796975713f77ca70eb
- SSDEEP 6144:Sae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKH3l6ImpwsrnG/X+:qmiMZvN43+u85Bpw+YMRkc9B0ImJLsX+
- TLSH
  T14AB48D19D7E405FDE0B7E578CD934902EB767C4A4771E68F03A499A21F332A09D3AB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2