discordrat | 2034799febba537d6f58e6e41c3b83b9c6ecd319accc0ca3c4ae83e7dd289dcd

General

Target
2034799febba537d6f58e6e41c3b83b9c6ecd319accc0ca3c4ae83e7dd289dcd
Size 496KB
Sample261027-w4mclawtaw
SHA256 2034799febba537d6f58e6e41c3b83b9c6ecd319accc0ca3c4ae83e7dd289dcd
MD5 515076fd93685fb11af60518cc18169e
SHA1 27c0a0d157303e551e0eee539f4a0b3c3604f722
SHA512 e28d2c9f36a90bf3a2e53007f13fdfefb92ec62f4b7b2b0033510308550e7db4c7b5368bcb2a8d2d1775edc101fa11817e265f929c120b43a50d8c175f55b3be
SSDEEP 6144:Uae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHd4Rloyk2wthlf:ImiMZvN43+u85Bpw+YMRkc9f4RXuF
TLSH
T149B48E19E7E804FDF1B3E678CD938912EB767C4A0771D68F03A059A61F236909D39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU2NDQ3ODQxNTkzMzkzOTgzMg.GCNsVp.IY8pX55sdFvm37tCPsbZ0NEFIike7ilQe0c-Vg
server_id
1564479125370970154

Targets

- Target
  2034799febba537d6f58e6e41c3b83b9c6ecd319accc0ca3c4ae83e7dd289dcd
- Size 496KB
- SHA256 2034799febba537d6f58e6e41c3b83b9c6ecd319accc0ca3c4ae83e7dd289dcd
- MD5 515076fd93685fb11af60518cc18169e
- SHA1 27c0a0d157303e551e0eee539f4a0b3c3604f722
- SHA512 e28d2c9f36a90bf3a2e53007f13fdfefb92ec62f4b7b2b0033510308550e7db4c7b5368bcb2a8d2d1775edc101fa11817e265f929c120b43a50d8c175f55b3be
- SSDEEP 6144:Uae7jdQz2diwcIXMRxHHbh43He6iU8msBcywGRYQ9RARc/1wKHd4Rloyk2wthlf:ImiMZvN43+u85Bpw+YMRkc9f4RXuF
- TLSH
  T149B48E19E7E804FDF1B3E678CD938912EB767C4A0771D68F03A059A61F236909D39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2