Behavioral task
behavioral1
Sample
Celery Bootstrapper.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Celery Bootstrapper.exe
Resource
win10v2004-20240426-en
General
-
Target
Celery Bootstrapper.exe
-
Size
204KB
-
MD5
02b71a38b3d55018b7f5c316543d5a8f
-
SHA1
c214652b538e94b19204e83e54483d911921d72a
-
SHA256
9e37c85517f2475ecb79759df8a479ac1ca0c1dc788bd961e55001adf3ee4004
-
SHA512
489de9c196ddd4cc92b3e3d9d20945c74cf3d0839940d0a2db88ab32bddf55e822c53f2c98034698eff72a28cc0da8b35527a8e5f9c3995109f68f0e323473fd
-
SSDEEP
1536:f2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PId+ovpfCfRRuaLgv+y1C3qzkn1:fZv5PDwbjNrmAE+HIMu2RuJGxB4RM
Malware Config
Extracted
discordrat
-
discord_token
MTE1NzU5MjUzOTQyODMwNzA2NA.Gco7Ft.BhtXaKRPsK-ZaaFbpomOTsGS41VToi1-dZqMqM
-
server_id
1165103369547939933
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Celery Bootstrapper.exe
Files
-
Celery Bootstrapper.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ