discordrat | silence[.]rar

General

Target
silence.rar
Size 726KB
Sample240319-t968vagg74
SHA256 8cd446387f47cd667943aba6e1e636c36fe07fb2dbc0990201fb3552ca8077e4
MD5 eb5b9e0f7e86d9d747afc116edfad2eb
SHA1 42b2cf0788d4850e0d4579b070e0ddd003f56968
SHA512 a43aeb76d2181556f5a7066ca3870cc34d83643f2500601653bf743185bdf6393bf98a2b6afee8dfe516c90b8cb78b1c727dbf36009daeed4400cccf354c6449
SSDEEP 12288:b8+iQ/KYfMFV1D0Zm/cLmEU3f+c8ZSu0nIdyAVdZ/1fF2EWxWsiFjbayXu8OOjph:bx/KWr3Ls3j8wu0IdfVTNnWiu8OOn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discordrat

Malware Config

Signatures

Discordrat family
discordrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/silence/silence-workspace.exe

File Explorer

silence.rar

.rar 726KB
silence/silence-workspace.exe

.exe 1.7MB
silence/silence.json

63B

silence.rar

SHA256 8cd446387f47cd667943aba6e1e636c36fe07fb2dbc0990201fb3552ca8077e4
MD5 eb5b9e0f7e86d9d747afc116edfad2eb
SHA1 42b2cf0788d4850e0d4579b070e0ddd003f56968
SHA512 a43aeb76d2181556f5a7066ca3870cc34d83643f2500601653bf743185bdf6393bf98a2b6afee8dfe516c90b8cb78b1c727dbf36009daeed4400cccf354c6449
SSDEEP 12288:b8+iQ/KYfMFV1D0Zm/cLmEU3f+c8ZSu0nIdyAVdZ/1fF2EWxWsiFjbayXu8OOjph:bx/KWr3Ls3j8wu0IdfVTNnWiu8OOn
MD5 SHA1 SHA512 SSDEEP

Password

buckute29

silence/silence-workspace.exe

IMPHASH 9222d372923baed7aa9dfa28449a94ea
SHA256 a8741e78c8b8b86042814e65b5a7ab358f1050757de3738a0d358097db996bd3
MD5 839a13e8b65aab0cb6d061ac82a8e3d4
SHA1 3de9d9d68c94493867bcb081d093bf39d45bf923
SHA512 ea2ded5b24dc88af32673957a7cc85c5b602fec5731c4af4d3cb9859009f0af6d2b9b629253090d23715af3b8030fc5727612f92a5339e08748fad5694eff2bc
SSDEEP 49152:O0xx0GTBlPBAc2AVMlsHbeucMYc5pSoUiGG8:OWTkcH3Hyo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

buckute29

Minor OS version

1

Major OS version

5

Entry point

12872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb

kernel32

CreateFileA FindResourceA FreeLibrary LoadResource WriteFile SizeofResource GetProcAddress LoadLibraryA LockResource EnumResourceNamesA CloseHandle FreeResource GetWindowsDirectoryA OutputDebugStringA GetTempPathA GetModuleHandleW ExitProcess DecodePointer EncodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetStdHandle GetModuleFileNameW Sleep HeapSize GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc LCMapStringW MultiByteToWideChar GetStringTypeW

shell32

ShellExecuteA SHGetSpecialFolderPathA

Resubmissions

Sharing