Behavioral task
behavioral1
Sample
Totally not a virus pistonware script without sub proof(real).exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Totally not a virus pistonware script without sub proof(real).exe
Resource
win10v2004-20230915-en
General
-
Target
Totally not a virus pistonware script without sub proof(real).exe
-
Size
78KB
-
MD5
9b42db3ec57f7348e44495bb31b7236e
-
SHA1
bba79b2b5170ff2b3a05947bf92d8dfacc08d9f1
-
SHA256
6e615525f43747c5b213c6b1cbd21faaad0dc166ed9d07d67c6d490df44fe076
-
SHA512
576de0e77d6cdaf2f50ada0e4a3f709215351140b27a7c9e6ed910fff36854a3e4a5d1982126325c8f08b50e85ff820c67242eb22f639f221de5e3ec99b87d65
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nPIC:5Zv5PDwbjNrmAE+PIC
Malware Config
Extracted
discordrat
-
discord_token
MTExMjQ2MzU2MjIyMTMwNTk5Ng.GvHMwb.ORB_WdCPPJtq54ntTQ9OzJslkILfR6sJSaCGRg
-
server_id
1155894496777732198
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Totally not a virus pistonware script without sub proof(real).exe
Files
-
Totally not a virus pistonware script without sub proof(real).exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ