08b996fb7c801cc260405dac24bc507da4af152f5e6b6aecd0277665fac1e53a

General

Target
Discord-Token-Password-Stealer-main.zip
Size 7KB
Sample260620-ds446aes7w
SHA256 08b996fb7c801cc260405dac24bc507da4af152f5e6b6aecd0277665fac1e53a
MD5 7c43c518514088e440088d083a85da18
SHA1 21d95397075a7943d5f57732d7505dcb5880aaae
SHA512 d395fb8a767335b84828469f90b7ee9c9a202207d3f8e950e83427bc8ea12d97fda904adba771dc276d9e8becb5072da7bc768e343eff0aa7429e4fe67de3b4c
SSDEEP 192:cs9NlNIg0UgbwX2xmlEK1+YUghWYBzeZ3CllPqYsaJ:LLYg02iHU+YUCBzC3NYsaJ
TLSH
T169F1E65AC0204D28C6A61B71B096454F0741EA0A1D5F78850CEF25DF38AFBE71A36EBF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Discord-Token-Password-Stealer-main.zip
- Size 7KB
- SHA256 08b996fb7c801cc260405dac24bc507da4af152f5e6b6aecd0277665fac1e53a
- MD5 7c43c518514088e440088d083a85da18
- SHA1 21d95397075a7943d5f57732d7505dcb5880aaae
- SHA512 d395fb8a767335b84828469f90b7ee9c9a202207d3f8e950e83427bc8ea12d97fda904adba771dc276d9e8becb5072da7bc768e343eff0aa7429e4fe67de3b4c
- SSDEEP 192:cs9NlNIg0UgbwX2xmlEK1+YUghWYBzeZ3CllPqYsaJ:LLYg02iHU+YUCBzC3NYsaJ
- TLSH
  T169F1E65AC0204D28C6A61B71B096454F0741EA0A1D5F78850CEF25DF38AFBE71A36EBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1
- Target
  Discord-Token-Password-Stealer-main/DiscordStealer/Program.cs
- Size 16KB
- SHA256 a78875b956f0b38132c4a0016f47369694c222bf4ef38ad91b252e7ec0655da5
- MD5 0ebbd9804b745a868302f39eb3bc999f
- SHA1 75f19cb1f34f33322a64f3ea3c1974f728d9e90c
- SHA512 f88bb28ccbe4eebc4c234f4335dad14d82f0811ca7c5e646441903695c5930320de3c6e463dcdad2737e2e3da9dacb9acacbfd4b9f9935a1f8b8a07c3b7282ba
- SSDEEP 192:Yi4h/E3zNirgt0ZgQav0xSATIcAY44MebIdyPdNiqsZdOT8I/ZoCHYdgiPKJ7F9a:Y9W3zz0fav0UsoY4Zebr7s/OTZhT4HL
- TLSH
  T15572873548468916B8B3D2AEAB119424E763722736768B62BDED37081FFC40452B4F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  Discord-Token-Password-Stealer-main/DiscordStealer/Properties/AssemblyInfo.cs
- Size 571B
- SHA256 47b3559a9be144af3bdde6bf41f3e01237f49b369fcff430149c3e909e6ee80c
- MD5 7d7d04134b8cef0d597f74de3e20e845
- SHA1 4e35dcd6ee34dde432a3595da844444e0f5e9bcd
- SHA512 e03d04d4a760c4e6e7bdda4b4fc4c6ffe6f91d7245494c2fa417e537092cd8224c49ddd1fe4a378db8a409fc80cd3504ac39670f6fec9cb9125d5a193e539fb3
- TLSH
  T1F5F032BD5605A74DCF4202E3BEA3B4C8422F336440EE0C1566EC3C03FC466B48268A27
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral3
- Target
  Discord-Token-Password-Stealer-main/DiscordStealer/Settings.cs
- Size 253B
- SHA256 83becd225a6e70131284611dd07e9efecbee1abaa0a97dc3ec2e82d2249a89ea
- MD5 68825f88910e8c47b59caaa4fccf9ea2
- SHA1 6e6f09ec8f94e14d317dce12c43ebe00d5d849fc
- SHA512 41857f9179d55cfeb348df80579a10cca533cc0e445bb56aef451af2ff78fcc686f6d8d892a1a2c98aec67b9a21e590445016f5291d9b65aed76b6ec92c97d13
- TLSH
  T191D097421218CA321A229160E30150BED71B21560E8B8A21789C12388F16292E278D5B
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral4
- Target
  Discord-Token-Password-Stealer-main/DiscordStealer/app.manifest
- Size 419B
- SHA256 e32d0d3880fc4d27b724a519fdb3a90c543628e26e0472a179bf52cbe6aef96d
- MD5 6edb2a82cd3779908d0e537fdc57b31c
- SHA1 7c83ee0701e2c87692d5c73a468baccb8db1166c
- SHA512 a167f49b70c9a5e4e2b642f98e63721b834146d659d7ec3f497a902a099faa8da0e2a7e29a05d550811a649ec98376f2dc82fb25c93fe84776af9b5946601714
- TLSH
  T121E0AB829084861A873001913B67A028D3A85307219F08AC34CD29BF6B1B6D080831B1
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  Discord-Token-Password-Stealer-main/DiscordStealer/discord.csprog
- Size 2KB
- SHA256 1bf8dc6d3bde74209b1aaefe495dc738c5e385547020521afccd40f157c578a2
- MD5 741076fe3e79a401c08f79518fb8ce8b
- SHA1 76720da3f64f90124040d4b17d514d95f7b86d7f
- SHA512 5aa9ff148e7a860f7f372098ef0d2ea6bc6f6d8376964d5c30e95c5ca09df05c7d8e7f413065e9d2bdab3da33adad8413bb4869580495547af114003a63bda6c
- TLSH
  T19741AF30D1D87E9646715437D2B39906DE6893E328E14CA8F75EE20F0B73A601153B73
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6