General
- Target Discord.Bot.Client.3.1.0.Portable.exe
- Size 83.4MB
- Sample260501-e7zzesby4s
- SHA256 20d26a2e4f5d5f542bac77bc3296e3d536a5387e33dc9be89109339d29b994b2
- MD5 7abfb7b07fb82841d58323ea74cbebb0
- SHA1 8c098cdf224d6d7799527afd6fbf4e64bc3e6012
- SHA512 fb45735310ccc43ae1638ef54bc8b376f99a6c92f190de771ad19f6b6d45bb7fe241a4bb81a1d79b584382ea78140caf6de2389c1b101913c28a764b448da28a
- SSDEEP 1572864:szbY69SQSdZ8hMEVixK+oGPpMAmjtT+zbY69SQSdtQKN5KwB/kqnlfcPXK+GuULb:6bt1SdShGddiMbt1Sd3KwqktcPK+B0fz
- TLSH T1F9183360D95F3A31F0F5EEB53A71B0F96C3CB14681D3AF628B66D5ADB5B00094803D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Discord.Bot.Client.3.1.0.Portable.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
Discord.Bot.Client.3.1.0.Portable.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral3
Sample
Discord.Bot.Client.3.1.0.Portable.exe
Resource
win11-20260130-en
Behavioral task
behavioral4
Sample
Discord Bot Client.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral5
Sample
Discord Bot Client.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral6
Sample
Discord Bot Client.exe
Resource
win11-20260130-en
Malware Config
Targets
-
- Target Discord.Bot.Client.3.1.0.Portable.exe
- Size 83.4MB
- SHA256 20d26a2e4f5d5f542bac77bc3296e3d536a5387e33dc9be89109339d29b994b2
- MD5 7abfb7b07fb82841d58323ea74cbebb0
- SHA1 8c098cdf224d6d7799527afd6fbf4e64bc3e6012
- SHA512 fb45735310ccc43ae1638ef54bc8b376f99a6c92f190de771ad19f6b6d45bb7fe241a4bb81a1d79b584382ea78140caf6de2389c1b101913c28a764b448da28a
- SSDEEP 1572864:szbY69SQSdZ8hMEVixK+oGPpMAmjtT+zbY69SQSdtQKN5KwB/kqnlfcPXK+GuULb:6bt1SdShGddiMbt1Sd3KwqktcPK+B0fz
- TLSH T1F9183360D95F3A31F0F5EEB53A71B0F96C3CB14681D3AF628B66D5ADB5B00094803D9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Discord Bot Client.exe
- Size 90.9MB
- SHA256 e060666bd5daa8b1489e9b6a894d59cafca313dd83af332460fa4b19378ae235
- MD5 08453e390b1c74da44d38fb40f657325
- SHA1 38ccafacfa7e2d9ea70230552f40c0cd4a34b7a4
- SHA512 9780128f503c7d0dc14950f98f25b0fb707c2d6f82191c7b30da29bd6447d1491ad6b004ed0af3690d373147b82e4b8b814285bade9766bd7e055920cb76df1d
- SSDEEP 1572864:W22RDw4z9BOjvo+7r+o6TPB0MoA0qcVqxLHmWgRywF+zGMW1BGglD0flenjMsN56:WxDRRBqN7sBwfRt0fwfwf
- TLSH T1F528AD02A452617DE84731B2351DF73E9D20464B4B398FD7EB9C6CE12FB81E2263B646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.