empyrean | 22c608eac14edf82c42954b3b4aaac440467d3e0e7b5cb84fd9bf0a209eacb4d

Resubmissions

06/04/2025, 03:56

250406-ehqdpatn18 10

Sharing

Copy URL

Twitter E-mail

General

Target

discord-image-logger-main (extract.me).zip
Size

19.3MB
Sample

250406-ehqdpatn18
MD5

31d00dd949141ebede1677228bee7a6c
SHA1

f02a6b7b34747788b0512bbf78719525d09451d3
SHA256

22c608eac14edf82c42954b3b4aaac440467d3e0e7b5cb84fd9bf0a209eacb4d
SHA512

787a0d943a57d1ff60605ea237910db95fbf0c831cbb8448628304d728f083978501b2d420c812f29636aba05a537fefe8e4e418ec439c942943b2b8fff881fe
SSDEEP

393216:NSrTOy8VHGBpHmFff1RhS8WThZpB3O/J6Yk6SwjL2i95UcupBR5qvdMw9Y3EKvot:NSrTqRGjHml1Rw88h9aMYkVwjL2i9C1M

Score

10^/10

Malware Config

Targets

- Target
  
  discord-image-logger-main/discord-image-logger-main/setup.exe
- Size
  
  37.2MB
- MD5
  
  7d7cf419472226353cad4fa52730b5e4
- SHA1
  
  d545b9124465f3a37bd30adf74158ca94d223622
- SHA256
  
  b2f974a98abb0cb61bfa61c58887a2a0acb73f9b16074d2bd740f2c66c9fe513
- SHA512
  
  7e51e533dbdf6b42b3f9e51a2ef3e7b20c532053d0b46d8aac277d1cfd4e1638f5692983dff5ac7fd805c996240cd048089b72965fe75a922ad5029b801dec1a
- SSDEEP
  
  393216:JQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgU96l+ZArYsFRlCbC:J3on1HvSzxAMNUFZArYsKbG/Pvx7OZQn
Score

8^/10

discovery execution persistence spyware stealer
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/components/antidebug.py
- Size
  
  11KB
- MD5
  
  26435fe69fcfe6322679c9df730cd0b0
- SHA1
  
  95a305df9fae655cc4b34eb0d5cad8848a4c9100
- SHA256
  
  101b5276bcaae253319cfc1f0f6b6a1688d9286c7852f8e12d00c698b2ae117c
- SHA512
  
  26e7750c235cfc734d86502f85f1620c4698bde6e377a2264bddd3017bb8891110e49ead665b59330666d2dd4686c8e657fb080554905dbb9976c8846781c963
- SSDEEP
  
  192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/V/c:0ZTd+nJYJzrn+rgeeWaOJjd5vpVC6
Score

3^/10
behavioral2
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/components/browsers.py
- Size
  
  16KB
- MD5
  
  1fa5ec2594e7dc5ba902baa17c26c396
- SHA1
  
  9cc476e8f5068edde04fb74b8d553b9920bb7e22
- SHA256
  
  fcc7ce278bc39a6f36772e45ca5a9c52bc1457bbcb451587c8812fe090fe0e37
- SHA512
  
  57ff299400b36ad38fb04728c6416c3b45decc88f6258a5df66bf6bd388575c7ccee5837e0903f44bfb90ff319a9bf6cee046ea316a8f50f365e9418e888b922
- SSDEEP
  
  384:ljE+Bs45wvwmzwCN903g6YeNlO3+B73Rk:BE+SYrCN903g6PNlO3+B7K
Score

3^/10
behavioral3
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/components/discordtoken.py
- Size
  
  17KB
- MD5
  
  c3d9cbff92171f3004bb29fc5c8e0d49
- SHA1
  
  972e9a36b103a7c41a26d7f1817ffeeff8dbfb3c
- SHA256
  
  18df4cedcec576281fa110f1597b8c300a6d8915fb34a05616b92ce00a1108ce
- SHA512
  
  3ba2c6a271cec1b7988f39aa43358bb2fdcf7581dfbbca55adc568595995a1388b53a73279833fac747775304d6d58a98b02830082d164ead89cb1a23e3e7de2
- SSDEEP
  
  384:ig9WPIDbhMUN7Qr4cq4cn6vPuk6ii34zSJPuE8q7rqLFBISJ:4Iz7C4F4o6XuVii34zSr8cr8vpJ
Score

3^/10
behavioral4
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/components/injection.py
- Size
  
  2KB
- MD5
  
  1bfaa460966bb67499e24c44e2ae4f3f
- SHA1
  
  d79d21cd4518324d0c59fa6e183bc91df1c08433
- SHA256
  
  a9d1ad9132081e78a68e9bc71d315b74b4005f67e2667dc933db2be79e297e6c
- SHA512
  
  6e1fe9f8a5359abb7409f5b6177908968d5714dabb6e647b7a63c88ae02f06d7c16acb13895d896688ca4558ee64f2f80f2b02ec37879bd5b4b4bd7b5c66221f
Score

3^/10
behavioral5
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/components/systeminfo.py
- Size
  
  6KB
- MD5
  
  2737cd3bd851c13c1c5c651e045e75d7
- SHA1
  
  828797243a9051d1461abebb90e162bd192f2c8a
- SHA256
  
  6689a267860ff5972229c33934af6356b4828b05ae214d2024f62bd113916a4a
- SHA512
  
  01d7b0e9c77585e08516c2443797f77c45db861a23f38fccad80036fe3f3ba270add2946317ef5405c608c2f8628910cf38c511cc8d7e94987730e3fe8f71e10
- SSDEEP
  
  96:o62a5Q8kjqXmBHyCOMLdpvlGa4sVV2iHxhwqf+zadcTP9eTnSIf:PQRy4Tka/T2UIzaaL9erj
Score

3^/10
behavioral6
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/config.py
- Size
  
  197B
- MD5
  
  f9db0f9a37e5d0b737dd22c3a0473d6d
- SHA1
  
  21b489d27337761e2dd5d6c50f4114ad73777800
- SHA256
  
  dc3606aa2b6342da0fe23a0a5859cf2f2be3d4bc0ec49f0dd4c79201db68c541
- SHA512
  
  12b32a522d848c76b984182f9827d22aea2e7c282b0f03db7b5d78e121157de6b67ee0e6031a44067c59efa146f1d5515514f9e27232778a56720582b7ec7d1d
Score

3^/10
behavioral7
- Target
  
  discord-image-logger-main/discord-image-logger-main/src/main.py
- Size
  
  848B
- MD5
  
  c7e2a6f36eead941802e707eb246da84
- SHA1
  
  4406272e8c7a9b8cb5684373c43f3368b2cb44dd
- SHA256
  
  eff558ffa171814712d1605c72fe8eba833f1682ef7efc8285dcf5303f4c5f41
- SHA512
  
  a6191c28c66c9c33d7bf070b36b5cb6ace45e06593cf4368cfd60e10a28bc846100be7efa025e1e12f5b4c3e0217ae5ec185142d1a4ea5db7aa1a5d585afdbeb
Score

3^/10
behavioral8