c361746fbc8c4020d7220c70845a92b03db82d3dc13289ff81a3c1720d1b6082 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

DiscordSetup.exe
Size

109.1MB
Sample

240813-zz5vxs1ckp
MD5

f25b0f68070257601e6990578a6e25cb
SHA1

20278a55eefa246b28d11a4b7ce394ce934ddf33
SHA256

c361746fbc8c4020d7220c70845a92b03db82d3dc13289ff81a3c1720d1b6082
SHA512

d49753bf89c814a83d2314d825c7d0d72f5b66b9429b51e42c8f3102e8a1877ff8bd9a7892877d6eabfe97a00533c934ebefd2b8058a7e5ba745e3c821fce40e
SSDEEP

3145728:9NEmmQbWysG0fCU9j41MOR7t6LF88gkXBQI/4lWM:9qvQb1eKUduMcRuC8g4QIAlJ

Score

7^/10

discovery persistence spyware stealer

Malware Config

Targets

- Target
  
  DiscordSetup.exe
- Size
  
  109.1MB
- MD5
  
  f25b0f68070257601e6990578a6e25cb
- SHA1
  
  20278a55eefa246b28d11a4b7ce394ce934ddf33
- SHA256
  
  c361746fbc8c4020d7220c70845a92b03db82d3dc13289ff81a3c1720d1b6082
- SHA512
  
  d49753bf89c814a83d2314d825c7d0d72f5b66b9429b51e42c8f3102e8a1877ff8bd9a7892877d6eabfe97a00533c934ebefd2b8058a7e5ba745e3c821fce40e
- SSDEEP
  
  3145728:9NEmmQbWysG0fCU9j41MOR7t6LF88gkXBQI/4lWM:9qvQb1eKUduMcRuC8g4QIAlJ
Score

7^/10

discovery persistence spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoverypersistencespywarestealer