discordrat | Loader 1[.]0[.]zip

General

Target
Loader 1.0.zip
Size 1.2MB
Sample240707-131wtaygql
SHA256 0b179ae27d3aa66de1646eec4f31571171cb8cceb2a11c8410afd237213af46f
MD5 6d44e623369352e9559a6687a6cc6038
SHA1 27bdc7992463cb7ab18cfc6ce50495dd8a8167bc
SHA512 60692008c74bd5b6ca46fa5e391e22e8b72eba6eb187493b5faa04af380168bf9271ef152bc5409769299fffe4b6b9a66bc6130249a22372e571753f78843ea1
SSDEEP 24576:G1PHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcMEZ:Lm/BQWgwwM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discordrat

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjkxNTA1ODEzOTcyOTkyMA.GgcvFH.ZZtWziWR04JaiPJgPsf437j8uiy-5kqu0pM8H4
server_id
1256913520704884807

Signatures

Discordrat family
discordrat

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Loader 1.0/Loader 1.0 .exe-ob.exe
unpack001/Loader 1.0/dnlib.dll

File Explorer

Loader 1.0.zip

.zip 1.2MB
Loader 1.0/Loader 1.0 .exe-ob.exe

.exe 79KB
Loader 1.0/dnlib.dll

.dll 1.1MB

Loader 1.0.zip

SHA256 0b179ae27d3aa66de1646eec4f31571171cb8cceb2a11c8410afd237213af46f
MD5 6d44e623369352e9559a6687a6cc6038
SHA1 27bdc7992463cb7ab18cfc6ce50495dd8a8167bc
SHA512 60692008c74bd5b6ca46fa5e391e22e8b72eba6eb187493b5faa04af380168bf9271ef152bc5409769299fffe4b6b9a66bc6130249a22372e571753f78843ea1
SSDEEP 24576:G1PHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcMEZ:Lm/BQWgwwM
MD5 SHA1 SHA512 SSDEEP

Password

infectes

Loader 1.0/Loader 1.0 .exe-ob.exe

SHA256 e24dc13510c766e09e987d58d4865a6b181cd142b23abdf5300ab7fae7238745
MD5 960e76f1b4738738a64fdbcde10cd534
SHA1 4ec4471c3663a12758144cf5dd207648d1eca9cf
SHA512 cb89bce320a50f7de1184b7b01e069ea6eaa2a6cb49b7fa3365d3c8537c07a13b5492c6fdcb83f028208b8d72f8666dfbf053da9b2b5f06842eea215e13b7d39
SSDEEP 1536:22WjO8XeEXFh5P7v88wbwNrfxCXhRoKV6+V+iPI2:2Zv5PDwbwNrmAE+OI2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infectes

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Loader 1.0/dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4758c7c39522e17bf93b3993ada4a1f7dd42bb63331bac0dcd729885e1ba062a
MD5 508ccde8bc7003696f32af7054ca3d97
SHA1 1f6a0303c5ae5dc95853ec92fd8b979683c3f356
SHA512 92a59a2e1f6bf0ce512d21cf4148fe027b3a98ed6da46925169a4d0d9835a7a4b1374ba0be84e576d9a8d4e45cb9c2336e1f5bd1ea53e39f0d8553db264e746d
SSDEEP 24576:WHjoaczZfdE55hHl0WQ/OO4yb99MANKtv7f2dcME:tm/BQWgww
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infectes

Minor OS version

0

Major OS version

4

Entry point

1167430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/obj/Release/net45/dnlib.pdb

Loader 1.0.zip

Loader 1.0/Loader 1.0 .exe-ob.exe

generic

Loader 1.0/dnlib.dll

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Loader 1.0.zip

Loader 1.0/Loader 1.0 .exe-ob.exe

generic

Loader 1.0/dnlib.dll

mscoree

dotnet