Behavioral task
behavioral1
Sample
Galaxy-swapper.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Galaxy-swapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Galaxy-swapper.exe
-
Size
78KB
-
MD5
60aeee0ddd73c986c7f17c6748f2690c
-
SHA1
8b2817e751e786ac8b6951897ccec7bfeb9b1a6b
-
SHA256
2806b1ba71cfeb21bfdbc1a92f3a7727d7e72d004b14cf9c0f2600b5786670a8
-
SHA512
decc43ef498f3ed3e05534bbb2ed6c46e5cb2a84a3534731fb03bef644987cf08db962ae060d95c207321a202343d5f25a7cdeda832b60bb8098c7bae7498505
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FKPIC:5Zv5PDwbjNrmAE+oIC
Malware Config
Extracted
discordrat
-
discord_token
MTI4NjI3NzM2OTQwMDkxODA0Nw.GNuVvm.hlPoyJnYnI0BY7XNiNy5yux87qxn92tKUsmuMI
-
server_id
1316157209415127040
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Galaxy-swapper.exe
Files
-
Galaxy-swapper.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ