discordrat | ba9de7070452c4b78776a6f23058b7088cc7159cb81344e18264e305508d600d

General

Target
2026-11-01_db52dce6fc07e7516f5d4edcd3e4e4fe_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
Size 1.7MB
Sample261102-hd166stt4q
SHA256 ba9de7070452c4b78776a6f23058b7088cc7159cb81344e18264e305508d600d
MD5 db52dce6fc07e7516f5d4edcd3e4e4fe
SHA1 f4ee31ac1b53be99869e235ac690ee65f36c95cc
SHA512 88092028b16b92c29d982f2dc951955c7b8a27dba5824f1f881a7e9b8794f20756f20b39d98ae054adda0ae8fe7924c984e21d9d0c48f7bcb1e19eab449f07cb
SSDEEP 24576:zHmUMa0uQlkjOx7WSHl6ijasYXKvEsDuH:7mja0JlkjORWH4v1
TLSH
T1F8854A0BBCD418B5C0AE96368A76A1927A31BC580F3163DB3E90B77C2FB27D05A75744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTU2NjEwNjU0MjI1NDcxOTA0Ng.GdFThD.zOtZqoFl45lEKll0Qw6yULAQ9QzXbFGn2Sedak
server_id
1566090571276361758

Targets

- Target
  2026-11-01_db52dce6fc07e7516f5d4edcd3e4e4fe_frostygoop_hive_luca-stealer_salatstealer_sliver_snatch
- Size 1.7MB
- SHA256 ba9de7070452c4b78776a6f23058b7088cc7159cb81344e18264e305508d600d
- MD5 db52dce6fc07e7516f5d4edcd3e4e4fe
- SHA1 f4ee31ac1b53be99869e235ac690ee65f36c95cc
- SHA512 88092028b16b92c29d982f2dc951955c7b8a27dba5824f1f881a7e9b8794f20756f20b39d98ae054adda0ae8fe7924c984e21d9d0c48f7bcb1e19eab449f07cb
- SSDEEP 24576:zHmUMa0uQlkjOx7WSHl6ijasYXKvEsDuH:7mja0JlkjORWH4v1
- TLSH
  T1F8854A0BBCD418B5C0AE96368A76A1927A31BC580F3163DB3E90B77C2FB27D05A75744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution discordrat persistence rat rootkit stealer
- Family: Discord RAT
  A RAT written in C# using Discord as a C2.
  stealer rootkit rat persistence discordrat
- Detects executables containing URLs to raw contents of a Github gist
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Discord RAT

Detects executables containing URLs to raw contents of a Github gist

Executes dropped EXE

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2