Behavioral task
behavioral1
Sample
verlpa.exe
Resource
win10-20240221-en
General
-
Target
verlpa.exe
-
Size
78KB
-
MD5
b10089e24aa1be03a0f363de21379086
-
SHA1
c500202cee0d25a0a045a7795cd6ae0ac06e740c
-
SHA256
451f315d253022f982cb4bdc793a46d5900f35369f75fabcdfe302af0e34a6b9
-
SHA512
cc99a13a284e8e53f146fa84f3c17a11d01962987726d8c3a9b6e7c97e72dc3f88a1908d788eafe039dc0bac5ed634cc9048c7940263b6220fefd39cfe17ecf0
-
SSDEEP
1536:S2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YAPIh:SZv5PDwbjNrmAE+YkIh
Malware Config
Extracted
discordrat
-
discord_token
MTIxMzgyMTc3MzY3NDU4MjAyNg.GaCfL7.8w9X1FxVo1vKg9WqG7FfPvOOz0wQx0VTARhCLM
-
server_id
1215177429937688606
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource verlpa.exe
Files
-
verlpa.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ