General
-
Target
PoabGrabber.exe
-
Size
6.1MB
-
Sample
241229-h9qqbawnfp
-
MD5
735103629b36f00e5e0f2d366eaae44f
-
SHA1
0c71ea959fcf6f3549ad3d7b9392157f54939bdc
-
SHA256
7c0ea7aaa73815e7a3e7a459b567024bb418afab7a9e2b638a667e2ae331e282
-
SHA512
f499e720129abfec0c0c5bec2cdfd0d2aac04e2e2225e1992c330332aaf317b1695903875a184d31e4a45e28d5711b2fa3b5771e7541e9a6ada3728dbfed8192
-
SSDEEP
196608:W0umWQLVOjmFwDRxtYSHdK34kdai7bN3m2kSvW863:SwwK2pM9B3QtWi3
Behavioral task
behavioral1
Sample
PoabGrabber.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PoabGrabber.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
discordrat
-
discord_token
MTMyMjU3MTk2NDc1MzM4MzQzNA.Gv_tyW.c2mPpnZyoEbjQAuLnYJeYs1MlEgjP2g9Mw53Ro
-
server_id
1322573461851471983
Targets
-
-
Target
PoabGrabber.exe
-
Size
6.1MB
-
MD5
735103629b36f00e5e0f2d366eaae44f
-
SHA1
0c71ea959fcf6f3549ad3d7b9392157f54939bdc
-
SHA256
7c0ea7aaa73815e7a3e7a459b567024bb418afab7a9e2b638a667e2ae331e282
-
SHA512
f499e720129abfec0c0c5bec2cdfd0d2aac04e2e2225e1992c330332aaf317b1695903875a184d31e4a45e28d5711b2fa3b5771e7541e9a6ada3728dbfed8192
-
SSDEEP
196608:W0umWQLVOjmFwDRxtYSHdK34kdai7bN3m2kSvW863:SwwK2pM9B3QtWi3
-
Discordrat family
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3