Overview

overview

10

Static

static

10

discord-im...er.bat

windows7-x64

4

discord-im...er.bat

windows10-2004-x64

10

discord-im...bug.py

windows7-x64

3

discord-im...bug.py

windows10-2004-x64

3

discord-im...ers.py

windows7-x64

3

discord-im...ers.py

windows10-2004-x64

3

discord-im...ken.py

windows7-x64

3

discord-im...ken.py

windows10-2004-x64

3

discord-im...ion.py

windows7-x64

3

discord-im...ion.py

windows10-2004-x64

3

discord-im...tup.py

windows7-x64

3

discord-im...tup.py

windows10-2004-x64

3

discord-im...nfo.py

windows7-x64

3

discord-im...nfo.py

windows10-2004-x64

3

discord-im...fig.py

windows7-x64

3

discord-im...fig.py

windows10-2004-x64

3

discord-im...ain.py

windows7-x64

3

discord-im...ain.py

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    discord-image-logger-main.zip

  • Size

    9.5MB

  • Sample

    240604-v3zqvsea6z

  • MD5

    bda20f87c5066b9325c521ceb7a62865

  • SHA1

    f8b8a96666cb268d2a482c78fe4b59c4c425d025

  • SHA256

    63b3839dc82c4080192b0181cc8296f1ff1841e2c820260d41544795d70415c5

  • SHA512

    3f952f51118d2d22709bec949af0f9dd55ba0d279acaf534bd4e8c6e07a53b2e149b0470e099db15841a12c6d8a7d5cf2a9989cf3f689228f9e974cc6bb2933b

  • SSDEEP

    196608:hcJoTzcSydKCzyw9QoBIBPuk07PfGAySYEB3IMhYXvBj39gdmW34cJ:hcJwzcSRw9NWBP9+lySYecprumW34cJ

Score
10/10
empyreanquasarspywaretrojan

Malware Config

Extracted

Family

quasar

Attributes
  • reconnect_delay

    3000

Targets

    • Target

      discord-image-logger-main/builder.bat

    • Size

      14.9MB

    • MD5

      70a53c5ec35eefae927a0c413a89937a

    • SHA1

      1bc9a22903968bfc05b87c1082a5c4242802d4dd

    • SHA256

      a7aa6fa77e4931544a6966ef435400c52a79af300a548aca4e9c67f72218ac2d

    • SHA512

      c712f2b98b0eb8c4808e4abcee0cc6100fc3e7d445f40208da0429b754148f190083ce247f183bb112083c15b06f466cbe573fe01f47de3d7958d8624e8d9aae

    • SSDEEP

      49152:QYwuS617ST7nN2d57VTqUTm0AmK0jEHD5FQ/9gsyuEgPXiGncZwPnzLO1WtJHFi7:S

    Score
    10/10
    quasarspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      discord-image-logger-main/src/components/antidebug.py

    • Size

      11KB

    • MD5

      26435fe69fcfe6322679c9df730cd0b0

    • SHA1

      95a305df9fae655cc4b34eb0d5cad8848a4c9100

    • SHA256

      101b5276bcaae253319cfc1f0f6b6a1688d9286c7852f8e12d00c698b2ae117c

    • SHA512

      26e7750c235cfc734d86502f85f1620c4698bde6e377a2264bddd3017bb8891110e49ead665b59330666d2dd4686c8e657fb080554905dbb9976c8846781c963

    • SSDEEP

      192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/V/c:0ZTd+nJYJzrn+rgeeWaOJjd5vpVC6

    Score
    3/10
    behavioral3behavioral4

    • Target

      discord-image-logger-main/src/components/browsers.py

    • Size

      16KB

    • MD5

      1fa5ec2594e7dc5ba902baa17c26c396

    • SHA1

      9cc476e8f5068edde04fb74b8d553b9920bb7e22

    • SHA256

      fcc7ce278bc39a6f36772e45ca5a9c52bc1457bbcb451587c8812fe090fe0e37

    • SHA512

      57ff299400b36ad38fb04728c6416c3b45decc88f6258a5df66bf6bd388575c7ccee5837e0903f44bfb90ff319a9bf6cee046ea316a8f50f365e9418e888b922

    • SSDEEP

      384:ljE+Bs45wvwmzwCN903g6YeNlO3+B73Rk:BE+SYrCN903g6PNlO3+B7K

    Score
    3/10
    behavioral5behavioral6

    • Target

      discord-image-logger-main/src/components/discordtoken.py

    • Size

      17KB

    • MD5

      c3d9cbff92171f3004bb29fc5c8e0d49

    • SHA1

      972e9a36b103a7c41a26d7f1817ffeeff8dbfb3c

    • SHA256

      18df4cedcec576281fa110f1597b8c300a6d8915fb34a05616b92ce00a1108ce

    • SHA512

      3ba2c6a271cec1b7988f39aa43358bb2fdcf7581dfbbca55adc568595995a1388b53a73279833fac747775304d6d58a98b02830082d164ead89cb1a23e3e7de2

    • SSDEEP

      384:ig9WPIDbhMUN7Qr4cq4cn6vPuk6ii34zSJPuE8q7rqLFBISJ:4Iz7C4F4o6XuVii34zSr8cr8vpJ

    Score
    3/10
    behavioral7behavioral8

    • Target

      discord-image-logger-main/src/components/injection.py

    • Size

      2KB

    • MD5

      1bfaa460966bb67499e24c44e2ae4f3f

    • SHA1

      d79d21cd4518324d0c59fa6e183bc91df1c08433

    • SHA256

      a9d1ad9132081e78a68e9bc71d315b74b4005f67e2667dc933db2be79e297e6c

    • SHA512

      6e1fe9f8a5359abb7409f5b6177908968d5714dabb6e647b7a63c88ae02f06d7c16acb13895d896688ca4558ee64f2f80f2b02ec37879bd5b4b4bd7b5c66221f

    Score
    3/10
    behavioral10behavioral9

    • Target

      discord-image-logger-main/src/components/startup.py

    • Size

      1KB

    • MD5

      d17d405ca05de43451c90ed876382851

    • SHA1

      5d79d59b7c7d84da78b16c3b11ccc329a85974c6

    • SHA256

      e93db849ec64a2c100f7d07bb1267edb96177b4097573796213fe19623b85e57

    • SHA512

      7e2f8325cae28528d84fe1967ded6375d8b581d99a93d5b2dbae8f7a7af03c60cadacd21bd0d29771ccb0dc438e5aac30321f251db44124ab841f267a0ff887b

    Score
    3/10
    behavioral11behavioral12

    • Target

      discord-image-logger-main/src/components/systeminfo.py

    • Size

      6KB

    • MD5

      2737cd3bd851c13c1c5c651e045e75d7

    • SHA1

      828797243a9051d1461abebb90e162bd192f2c8a

    • SHA256

      6689a267860ff5972229c33934af6356b4828b05ae214d2024f62bd113916a4a

    • SHA512

      01d7b0e9c77585e08516c2443797f77c45db861a23f38fccad80036fe3f3ba270add2946317ef5405c608c2f8628910cf38c511cc8d7e94987730e3fe8f71e10

    • SSDEEP

      96:o62a5Q8kjqXmBHyCOMLdpvlGa4sVV2iHxhwqf+zadcTP9eTnSIf:PQRy4Tka/T2UIzaaL9erj

    Score
    3/10
    behavioral13behavioral14

    • Target

      discord-image-logger-main/src/config.py

    • Size

      197B

    • MD5

      f9db0f9a37e5d0b737dd22c3a0473d6d

    • SHA1

      21b489d27337761e2dd5d6c50f4114ad73777800

    • SHA256

      dc3606aa2b6342da0fe23a0a5859cf2f2be3d4bc0ec49f0dd4c79201db68c541

    • SHA512

      12b32a522d848c76b984182f9827d22aea2e7c282b0f03db7b5d78e121157de6b67ee0e6031a44067c59efa146f1d5515514f9e27232778a56720582b7ec7d1d

    Score
    3/10
    behavioral15behavioral16

    • Target

      discord-image-logger-main/src/main.py

    • Size

      848B

    • MD5

      c7e2a6f36eead941802e707eb246da84

    • SHA1

      4406272e8c7a9b8cb5684373c43f3368b2cb44dd

    • SHA256

      eff558ffa171814712d1605c72fe8eba833f1682ef7efc8285dcf5303f4c5f41

    • SHA512

      a6191c28c66c9c33d7bf070b36b5cb6ace45e06593cf4368cfd60e10a28bc846100be7efa025e1e12f5b4c3e0217ae5ec185142d1a4ea5db7aa1a5d585afdbeb

    Score
    3/10
    behavioral17behavioral18

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

12
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks