General
-
Target
https://objects.githubusercontent.com/github-production-release-asset-2e65be/420053020/cd6bba0a-aa01-4a59-9f21-83b1dc9d0f56?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230716%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230716T131657Z&X-Amz-Expires=300&X-Amz-Signature=4947ca7f94c0d1e3cb41b8fba50b1ba94df0ef6eb4db00448c246e53f9ad721e&X-Amz-SignedHeaders=host&actor_id=93836097&key_id=0&repo_id=420053020&response-content-disposition=attachment%3B%20filename%3DDiscord.AIO.exe&response-content-type=application%2Foctet-stream
-
Sample
230716-qljk4aga3t
Malware Config
Targets
-
-
Target
https://objects.githubusercontent.com/github-production-release-asset-2e65be/420053020/cd6bba0a-aa01-4a59-9f21-83b1dc9d0f56?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230716%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230716T131657Z&X-Amz-Expires=300&X-Amz-Signature=4947ca7f94c0d1e3cb41b8fba50b1ba94df0ef6eb4db00448c246e53f9ad721e&X-Amz-SignedHeaders=host&actor_id=93836097&key_id=0&repo_id=420053020&response-content-disposition=attachment%3B%20filename%3DDiscord.AIO.exe&response-content-type=application%2Foctet-stream
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-