General
-
Target
raven-executor.exe
-
Size
78KB
-
MD5
b78a1bbe33e33c801d9d138c52fad26e
-
SHA1
a3ebbeb5b4f22228e8363c92ee4e585799f3f5f9
-
SHA256
5875ec36bcf8bdd5219ba9b7bf1c12696a34ddf50f3e8945d994b425f7bd083e
-
SHA512
64d872fac7dd5b6a435e091a8409da3c8bdddb59711c948e0ed1392bad0c58249078752f0bb936a8a358ed822ad9b97c57c3ceba9895f3c8d4d21ae723cd5c46
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC
Malware Config
Extracted
discordrat
-
discord_token
MTE5OTEyOTQxMjkwMjMzODY2MQ.GjTmSd.8exiaHo8Q_AXvqReqsNwjAQC9bbGb9_lqSEIRY
-
server_id
1211856489854013460
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource raven-executor.exe
Files
-
raven-executor.exe.exe windows:4 windows x64 arch:x64
Password: 1234
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ