General
-
Target
Discord.exe
-
Size
9.0MB
-
Sample
240727-cjazaatamh
-
MD5
4ed7e13857eb5da8670eec53a81045fa
-
SHA1
38fa4a8a996be6cc84c763c8aa8f01849f30f38f
-
SHA256
952a41a2197b5bf7ba79132f0f7a91ff4ad162247b4e4e0a90541dd519675f43
-
SHA512
bf670be31beae9913f1b4ec09ee33abbb9f7a6450383bb4791de99dc25e9cd99a9c7288ded6d916dfe3197ba7b3da595fa35877f2ab13d03b0d63c149dddbfbd
-
SSDEEP
196608:zUXGi6Jutlt3kdF4mCkpvyWYsChGVImxGg62Gl:zUpsPdF4mTvyWyhGVImxGr2Gl
Static task
static1
Behavioral task
behavioral1
Sample
Discord.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
Discord.exe
-
Size
9.0MB
-
MD5
4ed7e13857eb5da8670eec53a81045fa
-
SHA1
38fa4a8a996be6cc84c763c8aa8f01849f30f38f
-
SHA256
952a41a2197b5bf7ba79132f0f7a91ff4ad162247b4e4e0a90541dd519675f43
-
SHA512
bf670be31beae9913f1b4ec09ee33abbb9f7a6450383bb4791de99dc25e9cd99a9c7288ded6d916dfe3197ba7b3da595fa35877f2ab13d03b0d63c149dddbfbd
-
SSDEEP
196608:zUXGi6Jutlt3kdF4mCkpvyWYsChGVImxGg62Gl:zUpsPdF4mTvyWyhGVImxGr2Gl
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-