Static task
static1
Behavioral task
behavioral1
Sample
Discord.AIO.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Discord.AIO.exe
Resource
win10v2004-20230220-en
General
-
Target
Discord.AIO.exe
-
Size
6.5MB
-
MD5
84737f0c7ed11f35c961c115bc85d88e
-
SHA1
5da7c57952ee10bb03881daf7f40b17af6751e05
-
SHA256
93cf710da75171b8f12abb3373cecebb3096ed8b04deb9e602ee434158876fb7
-
SHA512
f7c8389101ae1aa41e8364c0cc85a109d5bd41d1bbe532d2d9fdb794a7c2cbf3c264569c8983865a52eff469d7d04f6ac2ee799e43fdd896b4afbe495d764ddc
-
SSDEEP
98304:d7w0WYwOYA4vWVU4fgcmnH3EPIL6yFs9u/FpboNe7mZD7JOi9mq2Jo2N/03FIgcG:2s4vkmXas+6cOyR2JFNmWZCZ
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule sample disable_win_def
Files
-
Discord.AIO.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ