Overview
overview
10Static
static
10Proton cha...S2.rar
windows7-x64
3Proton cha...S2.rar
windows10-2004-x64
7Proton cha...ps.txt
windows7-x64
1Proton cha...ps.txt
windows10-2004-x64
1Proton cha...er.exe
windows7-x64
10Proton cha...er.exe
windows10-2004-x64
10Proton cha...op.ini
windows7-x64
1Proton cha...op.ini
windows10-2004-x64
1Proton cha...ib.dll
windows7-x64
1Proton cha...ib.dll
windows10-2004-x64
1Proton cha...on.jpg
windows7-x64
1Proton cha...on.jpg
windows10-2004-x64
3Proton cha...nu.png
windows7-x64
1Proton cha...nu.png
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Proton changer-CS2.rar
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Proton changer-CS2.rar
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Proton changer V1/READ ME • steps.txt
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Proton changer V1/READ ME • steps.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Proton changer V1/cs2 proton changer.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Proton changer V1/cs2 proton changer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Proton changer V1/desktop.ini
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Proton changer V1/desktop.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Proton changer V1/dnlib.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Proton changer V1/dnlib.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
Proton changer V1/preview/proton icon.jpg
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
Proton changer V1/preview/proton icon.jpg
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Proton changer V1/preview/proton menu.png
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Proton changer V1/preview/proton menu.png
Resource
win10v2004-20231215-en
General
-
Target
Proton changer-CS2.rar
-
Size
4.2MB
-
MD5
5e7d4a44617249849528ab41f8490db0
-
SHA1
f53bd239d106162106694ea655feb6d3e7f320e8
-
SHA256
763c59fe814a81905d091d64ebd2eb3afef7cb79ed3a6b89ed30bdf71c21cb29
-
SHA512
c7927abf5a48473450637424e6af95996e06f524dda76785f7ef9d910f32b697f96ea56afdf5347923f8ee573a6ab460abaf532f1ce188ef80a55faf270cc706
-
SSDEEP
98304:78MEUkkSdGHMIVCjgl4fmqDvAdZXAIsQRsxMmR95VwuGxhUA9a1:YM4pdGHJRlBqD4ZwQRsxFb5VwuGnJ9a1
Malware Config
Extracted
discordrat
-
discord_token
MTE4NjU4MjQ0NDI0NjMwMjc1MA.GASQUi.LuaeFID8dxnhe68i9050fjtf_7kpkREbUUyjoY
-
server_id
1186582928906530837
Signatures
-
Discordrat family
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Proton changer V1/cs2 proton changer.exe unpack001/Proton changer V1/dnlib.dll
Files
-
Proton changer-CS2.rar.rar
-
Proton changer V1/READ ME • steps.txt
-
Proton changer V1/cs2 proton changer.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Proton changer V1/desktop.ini
-
Proton changer V1/dnlib.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Proton changer V1/preview/proton icon.jpg.jpg
-
Proton changer V1/preview/proton menu.png.png