discordrat | 5c1cccbc13a4f34bdb131af1cb8b8e7bbd09f47841336e081e0d0025c61cd182

General

Target
2026-08-07_ec5d61a01359488fbc9a3a2e23d1ab1d_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 466KB
Sample260807-fnbcdsxfmf
SHA256 5c1cccbc13a4f34bdb131af1cb8b8e7bbd09f47841336e081e0d0025c61cd182
MD5 ec5d61a01359488fbc9a3a2e23d1ab1d
SHA1 fea713992b698e0d9a891893d6cac275cc3f885d
SHA512 b7fa384b2c67c50512ff03a51483ba4955969224142c1fe78f9355ebf6c1132b2f7d2382243d73f67c03a3b3d6f5414a02328468375034c828b3f1db51728870
SSDEEP 6144:4ae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHVlcLCY47Uo7dE:MmiMZvN43+u85Bpw+YMRkc9DmLCtm
TLSH
T17FA48D19D7F405FDE0B7E578CD834902EB76784A07B1E78F03A499A61F232A09D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTUzNDY0NDY2NTk3NzAxNjM3MA.GyQDQm.r76kR_JTAy_kt-F-uF1Yz7OHbJOGHhSqCDoEhY
server_id
1534645353062596638

Targets

- Target
  2026-08-07_ec5d61a01359488fbc9a3a2e23d1ab1d_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 466KB
- SHA256 5c1cccbc13a4f34bdb131af1cb8b8e7bbd09f47841336e081e0d0025c61cd182
- MD5 ec5d61a01359488fbc9a3a2e23d1ab1d
- SHA1 fea713992b698e0d9a891893d6cac275cc3f885d
- SHA512 b7fa384b2c67c50512ff03a51483ba4955969224142c1fe78f9355ebf6c1132b2f7d2382243d73f67c03a3b3d6f5414a02328468375034c828b3f1db51728870
- SSDEEP 6144:4ae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHVlcLCY47Uo7dE:MmiMZvN43+u85Bpw+YMRkc9DmLCtm
- TLSH
  T17FA48D19D7F405FDE0B7E578CD834902EB76784A07B1E78F03A499A61F232A09D39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2