Behavioral task
behavioral1
Sample
Pharaoh executor.exe
Resource
win11-20241007-en
General
-
Target
Pharaoh executor.exe
-
Size
78KB
-
MD5
ac602ff31d1129be588688ba9fb817c3
-
SHA1
7906b235c6ad4c72122198ec7b9be23dd42833a4
-
SHA256
c23bb4c0e5fa855bb65abd2d78866ab05889bcb2f7d57e059ca071091e699740
-
SHA512
e69ff869cbd51c67fa32d199ec671882648f16a641f8841631adf5b9ae4c496852aefae1387be5b12a616d52bf89d927a8a094187850b15f7278bbf0e5072168
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC
Malware Config
Extracted
discordrat
-
discord_token
MTMyNzQzMDAzNTM3NTY1Mjk0NA.Gona0D.U4USiJVqaeVQ1lTluE2D4rzs8gMjLpI7-b1Qws
-
server_id
1327344984113811487
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Pharaoh executor.exe
Files
-
Pharaoh executor.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ