Extracted

• • Target

    Discord Tool v.7.7.exe

  • Size

    65KB

  • MD5

    5ff4a7e0fefe94b3bbf86f2137577ff2

  • SHA1

    67d9e82ef85881813228e902fd7880e0ceba20b9

  • SHA256

    a562d44e4bf6ec4f8a15c420bc3343f56011b2b454862869e01471075cba1a7e

  • SHA512

    05edf0d3bc2da186f6a159ef6e5c6f0456fc0979e188c8e8cb62799e0c663515dd9d4aaf631ac8f7830934a618e6eca5fd94e0e1d39d14ee9fbf68e97e8319a4

  • SSDEEP

    768:kRwwGkRrFpObTMFIiVZTKb9hFrTbpkLZ9WBf6Owg5+OWhXBZ5/HA:kRxGW5kbTqgTbpm9g6jk+OWRxHA

  Score

  10^/10

  umbralxwormexecutionpersistenceprivilege_escalationratspywarestealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1