Behavioral task
behavioral1
Sample
RShade-Revied.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral2
Sample
RShade-Revied.exe
Resource
ubuntu1804-amd64-20231026-en
General
-
Target
RShade-Revied.exe
-
Size
78KB
-
MD5
99f7f37aaac00176397c7f6482d5947c
-
SHA1
8dd0ebe1dda019824ec1dd81ae0cfd6d8209b1e1
-
SHA256
b4817dcad83a97aea6c5d5c261502198670346ed5886ef3d7ee7f36fd4453460
-
SHA512
83d81c3062ea9158b136a3c8f5e175c64584acaddb054ffecd6971db12f5a95cda65735b1c036212904d4eb5a112ec38e0bc27e67919f9519480d4618597e211
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC
Malware Config
Extracted
discordrat
-
discord_token
MTE1MjM3MTQ2NjkyMzQxMzU5NA.GrLwKT.-IkptKJlb4jcpQGY_N5k9i1zvvMJcs_XgrSFWU
-
server_id
1173319707345047642
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RShade-Revied.exe
Files
-
RShade-Revied.exe.exe windows:4 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ