General
- Target DiscordBotClient-win-x64.exe
- Size 105.3MB
- Sample260622-t3699set4p
- SHA256 c03951baf6a5058471056c669a40b52988e7dc0065c0645bdaa6c4a6dfbc2a15
Score
9/10
Malware Config
Targets
-
- Target DiscordBotClient-win-x64.exe
- Size 105.3MB
- SHA256 c03951baf6a5058471056c669a40b52988e7dc0065c0645bdaa6c4a6dfbc2a15
Score9/10-
Renames multiple (651) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.