discordrat | SigmaBase[.]rar

Resubmissions

09-12-2024 11:08

241209-m8xjpaznhk 10

07-12-2024 19:56

241207-yn1lds1jcz 10

Sharing

Copy URL

Twitter E-mail

General

Target

SigmaBase.rar
Size

5.1MB
MD5

d0c067fb8571dc6b3fb712b587a9f815
SHA1

4e8b3dc0eecf3742d6ab2b7bbbd1bb62fb969e1d
SHA256

13cc2f2806d65c35f10a500e8e109c48c1b4ab12642ebdd5c0b3ae85c28fed53
SHA512

71228c7cab4c8e143d4f570aa237fb8a17b130044c1bf1100f0f4fdb0aee52ab41064a8a913e45fc1a56d608d0ff89c1da3680508d49b789f50ace07c109189a
SSDEEP

98304:yW0Jih/Oj2tvKBV3TGU28aPlqdFsmGhEdntT+w+rSK/5anNREjNYEN8:yW//Xe3xOPlqdXXdtT+rTwEpYl

Score

10^/10

discordrat

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxMzk0OTc0NTY1NTQ0NzY0Mw.GvqYM1.8ZwhOILcM3Ijsfbzqc8F-Cy7wfV5wKSv-BMD0I
server_id
1313949691574226985

Signatures

Discordrat family
discordrat

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/FortniteExternalBase/vdm/libary.hpp.exe
unpack001/x64/Release/quantum.dev.exe

Files

SigmaBase.rar
.rar
FortniteExternalBase/FortniteExternalBase.vcxproj
FortniteExternalBase/FortniteExternalBase.vcxproj.filters
FortniteExternalBase/FortniteExternalBase.vcxproj.user
FortniteExternalBase/ImGui/imconfig.h
FortniteExternalBase/ImGui/imgui.cpp
FortniteExternalBase/ImGui/imgui.h
FortniteExternalBase/ImGui/imgui_demo.cpp
FortniteExternalBase/ImGui/imgui_draw.cpp
FortniteExternalBase/ImGui/imgui_impl_dx11.cpp
FortniteExternalBase/ImGui/imgui_impl_dx11.h
FortniteExternalBase/ImGui/imgui_impl_win32.cpp
FortniteExternalBase/ImGui/imgui_impl_win32.h
FortniteExternalBase/ImGui/imgui_internal.h
FortniteExternalBase/ImGui/imgui_tables.cpp
FortniteExternalBase/ImGui/imgui_widgets.cpp
FortniteExternalBase/ImGui/imstb_rectpack.h
FortniteExternalBase/ImGui/imstb_textedit.h
FortniteExternalBase/ImGui/imstb_truetype.h
FortniteExternalBase/aimbot.hpp
FortniteExternalBase/driver.hpp
FortniteExternalBase/drv_image/drv_image.cpp
FortniteExternalBase/drv_image/drv_image.hpp
FortniteExternalBase/entrypoint.cpp
FortniteExternalBase/function_spoofer.h
FortniteExternalBase/game.hpp
FortniteExternalBase/ida.hpp
FortniteExternalBase/imgui.ini
FortniteExternalBase/import_spoof.h
FortniteExternalBase/initalizer.cpp
FortniteExternalBase/initalizer.hpp
FortniteExternalBase/keybind.hpp
FortniteExternalBase/offsets.hpp
FortniteExternalBase/particles.hpp
FortniteExternalBase/render.hpp
FortniteExternalBase/sdk.hpp
FortniteExternalBase/settings.hpp
FortniteExternalBase/spoof.h
FortniteExternalBase/string_hider.h
FortniteExternalBase/util/loadup.hpp
.js
FortniteExternalBase/util/nt.hpp
FortniteExternalBase/util/util.hpp
FortniteExternalBase/vdm/libary.hpp.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FortniteExternalBase/vdm/raw_driver.hpp
FortniteExternalBase/vdm/vdm.hpp
FortniteExternalBase/vdm_ctx/vdm_ctx.cpp
FortniteExternalBase/vdm_ctx/vdm_ctx.hpp
FortniteExternalBase/x64/Debug/FortniteExternalBase.log
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/CL.command.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/CL.read.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/CL.write.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/Cl.items.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/FortniteExternalBase.lastbuildstate
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/fortnite_external_base.lastbuildstate
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/link.command.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/link.read.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/link.secondary.1.tlog
FortniteExternalBase/x64/Release/Fortnite.23e7437f.tlog/link.write.1.tlog
FortniteExternalBase/x64/Release/FortniteExternalBase.exe.recipe
FortniteExternalBase/x64/Release/FortniteExternalBase.log
FortniteExternalBase/x64/Release/drv_image.obj
FortniteExternalBase/x64/Release/entrypoint.obj
FortniteExternalBase/x64/Release/fortnite_external_base.Build.CppClean.log
FortniteExternalBase/x64/Release/fortnite_external_base.exe.recipe
FortniteExternalBase/x64/Release/imgui.obj
FortniteExternalBase/x64/Release/imgui_demo.obj
FortniteExternalBase/x64/Release/imgui_draw.obj
FortniteExternalBase/x64/Release/imgui_impl_dx11.obj
FortniteExternalBase/x64/Release/imgui_impl_win32.obj
FortniteExternalBase/x64/Release/imgui_tables.obj
FortniteExternalBase/x64/Release/imgui_widgets.obj
FortniteExternalBase/x64/Release/initalizer.obj
FortniteExternalBase/x64/Release/quantum.dev.exe.recipe
FortniteExternalBase/x64/Release/quantum.dev.tlog/CL.command.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/CL.read.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/CL.write.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/Cl.items.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/link.command.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/link.read.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/link.secondary.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/link.write.1.tlog
FortniteExternalBase/x64/Release/quantum.dev.tlog/quantum.dev.lastbuildstate
FortniteExternalBase/x64/Release/vc143.pdb
FortniteExternalBase/x64/Release/vdm_ctx.obj
fortnite_external_base.sln
quantum.dev.sln
x64/Release/imgui.ini
x64/Release/quantum.dev.exe
.exe windows:6 windows x64 arch:x64

375120b8f65aff4b369353b325cb5bac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\kido\Desktop\sodium\x64\Release\quantum.dev.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

VirtualAlloc
VirtualFree
LoadLibraryExA
lstrcmpiA
CreateToolhelp32Snapshot
Process32First
Process32Next
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
GetFileAttributesExW
GetFileAttributesW
FindFirstFileW
FindClose
Sleep
GetLocaleInfoEx
FormatMessageA
LocalFree
GetCurrentThreadId
SleepConditionVariableSRW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetModuleHandleW
GetFileInformationByHandleEx
WakeAllConditionVariable
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeviceIoControl
CloseHandle
CreateFileW
CreateFileA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentProcessId
GetCurrentProcess
GlobalAlloc
GetSystemTimeAsFileTime
InitializeSListHead
GetLastError

user32

LoadIconA
SetWindowLongA
UpdateWindow
GetSystemMetrics
GetAsyncKeyState
ShowWindow
DestroyWindow
RegisterClassExA
UnregisterClassW
PostQuitMessage
DefWindowProcW
PeekMessageA
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
GetClientRect
SetCapture
IsWindowUnicode
GetForegroundWindow
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
TrackMouseEvent
GetMessageExtraInfo
GetKeyState
GetCapture
ReleaseCapture

gdi32

CreateSolidBrush

advapi32

RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegCreateKeyA
RegOpenKeyA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
OpenProcessToken

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
_Mtx_lock
_Mtx_unlock
?_Throw_Cpp_error@std@@YAXH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Random_device@std@@YAIXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
_Thrd_join
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?good@ios_base@std@@QEBA_NXZ
?uncaught_exceptions@std@@YAHXZ

imm32

ImmSetCompositionWindow
ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

ntdll

RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
NtQuerySystemInformation
NtLoadDriver
NtUnloadDriver
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlInitAnsiString

vcruntime140

memcmp
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__current_exception_context
__C_specific_handler
__current_exception
memcpy
__std_terminate
memchr
strstr
memmove

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy
strncmp
_stricmp
tolower
strcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_wfopen
__p__commode
fflush
_set_fmode
fseek
fread
__stdio_common_vsprintf_s
ungetc
setvbuf
_fseeki64
fsetpos
fputc
fgetpos
fgetc
_get_stream_buffer_pointers
ftell
fwrite
__stdio_common_vfprintf
fclose
__stdio_common_vsprintf
__stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode
_callnewh

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-math-l1-1-0

acosf
ceilf
asin
atan2
log
tanf
sinf
cosf
logf
sqrtf
pow
fmodf
atanf
__setusermatherr
powf

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
_register_onexit_function
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
abort
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-time-l1-1-0

_localtime64
_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

Sections

.text
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/Release/quantum.dev.pdb

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 76KB - Virtual size: 75KB

.rsrc Size: 1KB - Virtual size: 1KB

375120b8f65aff4b369353b325cb5bac

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

d3dcompiler_47

kernel32

user32

gdi32

advapi32

msvcp140

imm32

dwmapi

ntdll

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 465KB - Virtual size: 465KB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 27KB - Virtual size: 34KB

.pdata Size: 17KB - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 76KB - Virtual size: 75KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 465KB - Virtual size: 465KB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 27KB - Virtual size: 34KB

.pdata
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB