Extracted

• • Target

    CS SkinCHANGER.exe

  • Size

    1016KB

  • MD5

    4baf19886d71c6d9312b3a71dcfea37e

  • SHA1

    ebacfba77117ec07d108f1b80e419be9674a48da

  • SHA256

    1d2005df287958967e785ebc022f183ed7b3878b631d75d61ed8d94bcda0ee58

  • SHA512

    0bb4d418ca83f1f85edcfbea1cf3704d42ebb9e3092c70f0a982238210adc9b51cfa47f19df67f7f2714444f04ac4bbf27887724f1dbcd6d1ba84c872074067c

  Score

  10^/10

  pandastealeragilenetspywarestealer

  • PandaStealer

    Panda Stealer is a fork of CollectorProject Stealer written in C++.

    stealerpandastealer

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Free Discord Nitro.exe

  • Size

    662KB

  • MD5

    98d08b7942589fe9e468a91f048dcd3d

  • SHA1

    af2950a505dd6e594f6f22305b939d5befafbe6f

  • SHA256

    2d18c676d4c1bbfa2939d36e88d95ece52af4220f0579a15d68642906a42f3c2

  • SHA512

    6672b5b900412a167d1d4e2bfaf4a2d901ed800cdb65f25645d498178839529dfb0de51610e59fb1de867a76fa8a82cdeb11ed4bfc55a4eefd356b510d62f4c5

  Score

  10^/10

  agilenet

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral3behavioral4