Behavioral task
behavioral1
Sample
doxtool.exe
Resource
win10-20240404-en
General
-
Target
doxtool.exe
-
Size
78KB
-
MD5
16d0fb269db477be08d333641dc063c6
-
SHA1
135e62c03692f27c9c3217a2d974702acdcfc122
-
SHA256
c75ed8e67edb12ce91b04dfc1155fe1abb3328fd4e8669bc5a0d64090b62f2d7
-
SHA512
c474547c749ffaa226c23fe0bc7f2dbd9da36e7ccb50626650c8365bac28f07b90f93c450210a8bcb9166f5f7046e9a69759be4fb9b2e804fd3df6c4adee899f
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC
Malware Config
Extracted
discordrat
-
discord_token
MTIzODI1MzczNzMwMzM0NzMyMg.GageoQ.lrQ8H8NI2J99-bJ1ou6AHy2TezHO3Qo24PieOI
-
server_id
1238097255248957492
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource doxtool.exe
Files
-
doxtool.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ