Behavioral task
behavioral1
Sample
bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
bootstrapper.exe
-
Size
78KB
-
MD5
bbcd1358829e3f227e2994cee4104a07
-
SHA1
ea5e32e8b9b2af737009cb6f80b6729b748fdfab
-
SHA256
92fce7a02eb2bcaa35ea632e9eb8534f44b0eb2839e94b7f80c91251fff5d251
-
SHA512
66af0ec9ba3d641ed50dd283fa61d5186824504d0779a6036300f4ecc24a6afc7e8143b1afd777d467b367cebe3258aab889cd317eba7cd21e5145ef5d90895c
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+1PIC:5Zv5PDwbjNrmAE+lIC
Malware Config
Extracted
discordrat
-
discord_token
MTMyNzkyMjgxNzUzODQ1NzY0MQ.GHccHA.ZdFmK2NR5y0hOF4icu1bgrMPm9-_Z95-15yAFc
-
server_id
1325467073790345276
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bootstrapper.exe
Files
-
bootstrapper.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ