Overview

overview

9

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows11-21h2-x64

9

Resubmissions

01/09/2024, 23:31

240901-3h2zgswbjh 9

01/09/2024, 21:59

240901-1v1wvasglj 3

Sharing

Copy URL Twitter E-mail

General

  • Target

    https://cdn.discordapp.com/attachments/1040687764573798402/1279923326101360670/W3jVp4f_1.zip?ex=66d634fc&is=66d4e37c&hm=a4457af32875de845d86967c20884eeaffa9f69b7d817a35ebfa5575571d573c&

  • Sample

    240901-3h2zgswbjh

Score
9/10
discoveryevasion

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1040687764573798402/1279923326101360670/W3jVp4f_1.zip?ex=66d634fc&is=66d4e37c&hm=a4457af32875de845d86967c20884eeaffa9f69b7d817a35ebfa5575571d573c&

    Score
    9/10
    discoveryevasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks