d24dddbdf2970f6a51611a193bcd839faf3d7a28d4dc96adcb3c20a11424209e | Triage

Sharing

General

Target

DiscordSetup.exe
Size

108.8MB
Sample

240627-j75xwstbnp
MD5

4a2bab1275706365277fbecc493b0bcb
SHA1

944287d298e5e3876d41f5416573091bfb27edf8
SHA256

d24dddbdf2970f6a51611a193bcd839faf3d7a28d4dc96adcb3c20a11424209e
SHA512

775c618c025f125e6fce586ec4727eede2761d75fc288ca0afece8723463e173ced87959ea706b4ec48ee477a92100ab1c3c2341311e1b0d4396b3a772e51ecc
SSDEEP

1572864:TPKunsjp0UyfrzJwWhQgQdCev9wChYAs9YLiC1lgno+r7BP9cSFc3YpnngmBXlI1:TPCp7wKq3VYLiC1iZvBPTFcgnFBVI1

Score

7^/10

persistence spyware stealer

Malware Config

Targets

- Target
  
  DiscordSetup.exe
- Size
  
  108.8MB
- MD5
  
  4a2bab1275706365277fbecc493b0bcb
- SHA1
  
  944287d298e5e3876d41f5416573091bfb27edf8
- SHA256
  
  d24dddbdf2970f6a51611a193bcd839faf3d7a28d4dc96adcb3c20a11424209e
- SHA512
  
  775c618c025f125e6fce586ec4727eede2761d75fc288ca0afece8723463e173ced87959ea706b4ec48ee477a92100ab1c3c2341311e1b0d4396b3a772e51ecc
- SSDEEP
  
  1572864:TPKunsjp0UyfrzJwWhQgQdCev9wChYAs9YLiC1lgno+r7BP9cSFc3YpnngmBXlI1:TPCp7wKq3VYLiC1iZvBPTFcgnFBVI1
Score

7^/10

persistence spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

persistencespywarestealer