C:\Users\LLAMA\source\repos\VeilUI\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb
Behavioral task
behavioral1
Sample
Oxegen Exec/oxegen.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Oxegen Exec/oxegen.exe
Resource
win10v2004-20240709-en
General
-
Target
Oxegen Exec.rar
-
Size
267KB
-
MD5
00fe1fa17133b11f1335653cf83ba40f
-
SHA1
16954cf7bd53166c606199027f562a4bdf897ae3
-
SHA256
3ef7eb0816dc3e90bd47be2620b53d57628d3d5fb79cfaef2166ee101504ce40
-
SHA512
f1d1042f1958e50940459a19f96a97eb86aa50510095abbd23cd1c56e8294921e2fda436fae3b92ab34581b77dd6d5c4b11d076f9616add32c7e17996943dc4f
-
SSDEEP
6144:ZiOuxHdpbz9Sut70XkRsSwsSKTub6ZnjrEKBjkF8mvOaDXMrWG24I0O:oOWHfbzP72kdSKTubEjrFaCmvOAsa
Malware Config
Extracted
discordrat
-
discord_token
MTI1NjYxMDkyODE0MTY2NDM0Ng.GoCAda.9jAnxnZbVToLnUTaW-wRrWIl-V07WOjBZlKZ6U
-
server_id
809482718164680734
Signatures
-
Discordrat family
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Oxegen Exec/FastColoredTextBox.dll unpack001/Oxegen Exec/oxegen.dll unpack001/Oxegen Exec/oxegen.exe
Files
-
Oxegen Exec.rar.rar
-
Oxegen Exec/FastColoredTextBox.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Oxegen Exec/Scripts/Ambient Gui by spicy.txt
-
Oxegen Exec/Scripts/Anti fog.txt
-
Oxegen Exec/Scripts/DJ table.txt
-
Oxegen Exec/Scripts/Destroy.lua
-
Oxegen Exec/Scripts/Elysian admin.lua.js
-
Oxegen Exec/Scripts/Explorer.txt
-
Oxegen Exec/Scripts/FE CHECKER.txt
-
Oxegen Exec/Scripts/Grab Knife V4.txt
-
Oxegen Exec/Scripts/Mlg particles.txt
-
Oxegen Exec/Scripts/Quick kick and other commands.txt.js
-
Oxegen Exec/Scripts/README.md
-
Oxegen Exec/Scripts/Ro-xploitv6.txt
-
Oxegen Exec/Scripts/Slow disco fog.txt
-
Oxegen Exec/Scripts/Wings.txt
-
Oxegen Exec/Scripts/anonymous all.txt
-
Oxegen Exec/Scripts/anonymous local player.txt
-
Oxegen Exec/Scripts/anti ff.lua
-
Oxegen Exec/Scripts/anti god.lua
-
Oxegen Exec/Scripts/autotime.lua
-
Oxegen Exec/Scripts/fedora admin.txt.js
-
Oxegen Exec/Scripts/rocky2u admin.txt
-
Oxegen Exec/Scripts/skeleton skybox.txt
-
Oxegen Exec/oxegen.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\White Cat\source\repos\STAPI\STAPI\obj\Release\STAPI.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 337KB - Virtual size: 337KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 856B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Oxegen Exec/oxegen.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Oxegen Exec/oxegen.exe.config
-
Oxegen Exec/oxegen.pdb
-
Oxegen Exec/workspace/auto_exec/test.txt