Behavioral task
behavioral1
Sample
DiscordTC.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DiscordTC.exe
Resource
win10v2004-20230220-en
General
-
Target
DiscordTC.exe
-
Size
5.7MB
-
MD5
d9c5692abdf8dfabed434534261b7d4f
-
SHA1
eded4f464442d03b70725037ebbc1f81d27f3fe3
-
SHA256
7ca97bd72e8eac0fe804d655bc99453cc8c612c671ce0cfc6147e20262945b80
-
SHA512
ffb802534f1a9454a3c454bfa52998431636ed7f2ef3d62fc41340af1cd734ef262b81d796587e6a601345d16493c8f7b875429a61ce4a8ab3e9ec08f9575bc9
-
SSDEEP
49152:XikcR48nCJ9g8QjQdphgh/+NHdRdkpfmSKTUgixB7/gMEgw918QlKx9ZkwHdKFr+:XX8n98QjOk9F3gi7IOwjCx4w9KF9T
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource DiscordTC.exe
Files
-
DiscordTC.exe.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 2.0MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE