c6bd3da755f382466610ed96d363e701cf044819b925684896af26b797abaa6d

Target

DiscordSetup.exe
Size

79.1MB
Sample

211201-vnszrsebek
MD5

3d99554cc8bdd96ab58483a21d821740
SHA1

85389db7e48c563d77cbef27e2f5724cbef4a151
SHA256

c6bd3da755f382466610ed96d363e701cf044819b925684896af26b797abaa6d
SHA512

be063484581b219ae27f6f515901bde14d03fa76adfe1bd33b9174a5551c719e09946548cd5acae0b5204dd21e6e349707cb06225a6d640a542eb15ec8aae183

Score

10^/10

Malware Config

Targets

- Target
  
  DiscordSetup.exe
- Size
  
  79.1MB
- MD5
  
  3d99554cc8bdd96ab58483a21d821740
- SHA1
  
  85389db7e48c563d77cbef27e2f5724cbef4a151
- SHA256
  
  c6bd3da755f382466610ed96d363e701cf044819b925684896af26b797abaa6d
- SHA512
  
  be063484581b219ae27f6f515901bde14d03fa76adfe1bd33b9174a5551c719e09946548cd5acae0b5204dd21e6e349707cb06225a6d640a542eb15ec8aae183
Score

10^/10

adware discovery evasion persistence spyware stealer trojan
- Registers COM server for autorun
  persistence
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
behavioral1