discordrat | dc2dfd1c81b1b18fcfb1abda84f0ddfb0274ebeeadb265bf55fbd4cf0e8d6b8f

General

Target
2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 517KB
Sample261003-lbkcescd66
SHA256 dc2dfd1c81b1b18fcfb1abda84f0ddfb0274ebeeadb265bf55fbd4cf0e8d6b8f
MD5 7df704f06651b56641b44a50d7fc1a82
SHA1 2b03ec2ad9aabe3d06bf8649d81c78d43a751b58
SHA512 9790d3912da7698f1aac7afaa902755e4f3a494664ab5a78cc60434b8c98a9cf8349988b0f2f8f6fc1a2a2563c3ecdc8f1dc3c73fbf32e13173b6aab12a3cac8
SSDEEP 12288:/RZeGAfqNGA3Uq29XIDixjpyq0BKbtUJY21c2M:/RSfrAEH9XIYpj0BKbtEkL
TLSH
T153B49E19E7E404FDE1B7E578CE934902E77678490771E6CF03A499A61F272908E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU1NDgxNTg4ODg4MzA1NjcyMA.GxhFij.Bq6hlo-mQo6_LoAEaNMir_-iko03h9ZApcauMs
server_id
1554814986759708713

Targets

- Target
  2026-10-02_7df704f06651b56641b44a50d7fc1a82_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 517KB
- SHA256 dc2dfd1c81b1b18fcfb1abda84f0ddfb0274ebeeadb265bf55fbd4cf0e8d6b8f
- MD5 7df704f06651b56641b44a50d7fc1a82
- SHA1 2b03ec2ad9aabe3d06bf8649d81c78d43a751b58
- SHA512 9790d3912da7698f1aac7afaa902755e4f3a494664ab5a78cc60434b8c98a9cf8349988b0f2f8f6fc1a2a2563c3ecdc8f1dc3c73fbf32e13173b6aab12a3cac8
- SSDEEP 12288:/RZeGAfqNGA3Uq29XIDixjpyq0BKbtUJY21c2M:/RSfrAEH9XIYpj0BKbtEkL
- TLSH
  T153B49E19E7E404FDE1B7E578CE934902E77678490771E6CF03A499A61F272908E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2