discordrat | rat[.]exe

General

Target
rat.exe
Size 78KB
Sample260910-xkfldaxsct
SHA256 0b2d8e20b7eff06bfb9a6ac927362e7a280ad0ca577e2509a80b9a6358a28b29
MD5 cf727f0e816bd8098b561d7a29c8bb97
SHA1 249f047fadf3b33a71c040c17f7c2d4e2e277d6b
SHA512 8399125a33379a0e46095ef5e0e7036b5cf2440977a571a394535abd60f30236ebe2491ad6df6853635303ae5a90f3aef88e4c8bc4f04c4d5312064f8723b40f
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BPIC:5Zv5PDwbjNrmAE+RIC
TLSH
T11773B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer rootkit rat persistence discordrat

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU0NzY2OTUxNTIwOTI3NzU0MA.G4ppOl.bdBKDOX9aO8i8g7GiUXcZTWZD3hvppkbLC23j0
server_id
1543514653987184650

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
rat.exe

File Explorer

rat.exe

.exe 78KB

rat.exe

SHA256 0b2d8e20b7eff06bfb9a6ac927362e7a280ad0ca577e2509a80b9a6358a28b29
MD5 cf727f0e816bd8098b561d7a29c8bb97
SHA1 249f047fadf3b33a71c040c17f7c2d4e2e277d6b
SHA512 8399125a33379a0e46095ef5e0e7036b5cf2440977a571a394535abd60f30236ebe2491ad6df6853635303ae5a90f3aef88e4c8bc4f04c4d5312064f8723b40f
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BPIC:5Zv5PDwbjNrmAE+RIC
TLSH
T11773B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing