Behavioral task
behavioral1
Sample
passwords.exe
Resource
win11-20241007-en
General
-
Target
passwords.exe
-
Size
78KB
-
MD5
513ecef8b9161f44f6d822a85d18734c
-
SHA1
8e8795f80d2c7db261c3c7457b4f06fb86266af4
-
SHA256
5a23b54943959e05cf195c9936d1016eeb264d7679bb802fe9ffd79e9bbfd7f3
-
SHA512
1f891e184af63c8f17a12c100060ce1abcc2208c1c928287a55489d35708d91c19bc7fea03e0098e659b3db3f6de3ede0f51e1794bfbff383243cb2a8a28b345
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC
Malware Config
Extracted
discordrat
-
discord_token
MTMzMzk4NzY2MTExMDU3NTEzNA.GBxxcG.hCxvPKnNhuDVqFwQAGcXXL8xZHa8nfwbs3kxmk
-
server_id
1334397739173281835
Signatures
-
Discordrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource passwords.exe
Files
-
passwords.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ