Overview

overview

9

Static

static

3

DiscordBot...1).exe

windows7-x64

9

DiscordBot...1).exe

windows10-2004-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target

    DiscordBotClient-win-x64 (1).exe

  • Size

    64.1MB

  • Sample

    231116-schzbace97

  • MD5

    9962b581cb5c9e50f4f255cbee809315

  • SHA1

    a57794d2b76b1b9a52c206727dbad5ca06a4a2c8

  • SHA256

    8936662f9ea02558bae3bcae8b5f9caea9b2b671526b35f3e50ea1d7e0b10a93

  • SHA512

    041e8bcf0fdb47edc7403622c8fb9b4f8407ac3a8b685a7e42c75424b4cef498864337cb2f62539dea7a1ec03b7f80f46542a1034f5fdd8cbf80dbbeaf6066b5

  • SSDEEP

    1572864:Zlwt27dE4Q/ywiuRcFQEFEkyxy3td80AzJrcPfl1Mq:ZG47dEzyDIy9d80kAMq

Score
9/10
discoveryransomware

Malware Config

Targets

    • Target

      DiscordBotClient-win-x64 (1).exe

    • Size

      64.1MB

    • MD5

      9962b581cb5c9e50f4f255cbee809315

    • SHA1

      a57794d2b76b1b9a52c206727dbad5ca06a4a2c8

    • SHA256

      8936662f9ea02558bae3bcae8b5f9caea9b2b671526b35f3e50ea1d7e0b10a93

    • SHA512

      041e8bcf0fdb47edc7403622c8fb9b4f8407ac3a8b685a7e42c75424b4cef498864337cb2f62539dea7a1ec03b7f80f46542a1034f5fdd8cbf80dbbeaf6066b5

    • SSDEEP

      1572864:Zlwt27dE4Q/ywiuRcFQEFEkyxy3td80AzJrcPfl1Mq:ZG47dEzyDIy9d80kAMq

    Score
    9/10
    discoveryransomware

    • Renames multiple (242) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks