e5cb1187b794d7f0e65b8bcdf94390f5b375e36d418b718d9c9111037b5daea7

Sharing

Copy URL Twitter E-mail

General

Target
Discord-Ddos-Bot--main.zip
Size 3.4MB
Sample260705-xg45kae161
SHA256 e5cb1187b794d7f0e65b8bcdf94390f5b375e36d418b718d9c9111037b5daea7
MD5 de1206f0feb47cec81700c97c6d094ac
SHA1 80467d20071b7282a5dfdd633627a974784a7df6
SHA512 9a1a66274e4a7adceee9cd1d8ed7e54ef60c6f4653ae77b3cb8b0cd949362963be6ecd897b082f1f38e03474944708b84d0dbfb0b90355e39e89833b9969e55a
SSDEEP 98304:zoZdUjEEgaOtlJoeXbbk+oJVIVYRa14ekhVc:0dJtMeHkxDIKRJ/hVc
TLSH
T177F533E5C54AA97CC9BCA6F61BA0E384638B7BDED727925015338D769EC32150301B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Discord-Ddos-Bot--main/HTTP-RAND.js
- Size 404KB
- SHA256 29b62306eabf117cb39cef354e03316cd24c07fc770b0f7195ca724dbbfb19e9
- MD5 9078dba168d9b12f07abb1201456b106
- SHA1 b2a2e1e154e09f4d2086cb6e122db0b76970f679
- SHA512 7893e049ac7db1310d9f80f239f20cf578f5a5502eee26a5f649ecf9112b1a7704043e8cb41e99d203dfeba16c04711a03d9f43315e673bcb2a1b7a6734f85b3
- SSDEEP 768:jSb7I/W8ecmVU65VxzVKsbdPemI8BNlTPrCjcG8ZSNmljNtCPbMETCLQcKy9eEMK:jSbvWbPZafSDqfNel5bAx
- TLSH
  T1F294C023CD208EE061254C46222E77D2A68A87BF89D721E3DDAF0A55FF50A57117FEC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Discord-Ddos-Bot--main/HTTP-RAW.js
- Size 283KB
- SHA256 9b2ccc5867b85cd2c4cc8e8a9282905b89e9a9347a501267d3bdf3f998951d5f
- MD5 f2b9e1830bf047f60fb4ecc1248b887f
- SHA1 c8de2135f2064e7463f291f205d7cfec877f963c
- SHA512 f0934f4147683f598b8d28854f156a99069dea8eca9b6d5297b9475f7be45e2e1df0a0161e47a5be1660ab80ec87746ed41f3860d9a1ebf5e7f5555d48208402
- SSDEEP 1536:EebK/Pxn2g4nFHRfnCkE8YMFMcBnA4mXZH4UcaoZHAxwJHAhjMAauWl4+e7bT9dn:ER0xJQhjjauB7lDkDUz5Lp
- TLSH
  T1345451DFC145949C7132AE41A373E798EEC394FAB29F67419AC11CC5A840B1B29397E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  Discord-Ddos-Bot--main/HTTP-SOCKETS.js
- Size 282KB
- SHA256 6c52f3e7201f09acee3fc5eba53d6d288e67dc6f43b10d221a0466856d9703f2
- MD5 a76334c3c8fe9fc3b527418181654801
- SHA1 39caab46a74576c41936c0a971b672c42649de94
- SHA512 ec31ccdf86a62591911217781c287eba0fd8098ab48f6dcfab82c4794b7ad0f17e22693f02a5a510aa7c7178d608fd9b855abb424ae7f7f5c3c7d6e28c872b79
- SSDEEP 1536:S+ameG1qVNP/EBGJ+Ubh2jStTMM5TSnGtfkfvYbckAkQUi2VmjnWqvRfz8BViU3s:ajCTpRRgK
- TLSH
  T1FE540FDFC105A46C7132AE60A233DB9DDDC329E6F29F6742D9C11CC5A882F1B11796E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Discord-Ddos-Bot--main/bot.py
- Size 26KB
- SHA256 ac908fe8452ad9003d09bbcbae5f583e9f97f6f748806a98e8f6e8e24fb6af3b
- MD5 d71a4ff7888a6f3eeb78ede7fd4a03b1
- SHA1 bd985539edc66666b2ad5c5ebd2048b3a4afd364
- SHA512 bc88f472cf06ec042fc8a77c9b0a3466f031b9e55218c643d016119aa20564c4f15cf501a24a5ede3f673b5ce4a7fe24fdb9d064c619e7e47383ac9d52d6bdb7
- SSDEEP 384:09LMlIoiyn4smDksTdZ5l/8BUa/sJwpzJp:MolbmhTf/8BUa/sJkz7
- TLSH
  T172C2951BF965AF23327318ED5D314491F22269A8B9B9B5D37DAD9C0F1728822F0439D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Discord-Ddos-Bot--main/bypasserr.js
- Size 1KB
- SHA256 150e3a4cf7ec438dc202adca991e01501ca02c23c28e8f34a82da300e08ba730
- MD5 fcdba0e0bc3872d879e32101f2b589b9
- SHA1 b75f930d3e65bc895fbf29d99860804c91d7df1b
- SHA512 de2d4e7da0e636ef3e7b14478660a32a68395c3eb28ec379a1da5382fdfae46094da7dac52b48bcc4359cf2ce97e42f3b335ded4fc0d4dbc9c958835717e7d4a
- TLSH
  T1EE313554B6E54838256262DEA88F111A38E293337507D9B5B08DC1A78FB6AA47003DED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Discord-Ddos-Bot--main/cf.js
- Size 1KB
- SHA256 87c379a9c812ff8c287db3f437e1eb75df184e2b04235de385d5cd8f454b6922
- MD5 ef75cf4b0d2c2a294df2e20f756044a0
- SHA1 8e365fe891f2d3afc8466e8a792b4599b4da94bb
- SHA512 e4afa05b68897be3e3490f72e655b92bdc57836608e29885b51690ab28535caf021a623079b15648c9370d308dd17be77d668fdf796c985a6e310fa5b1e59558
- TLSH
  T10E41F65666BB20290672546BB55F810B245762133282D97CF31C42674FDA52ED0F16FF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Discord-Ddos-Bot--main/hyper.js
- Size 17KB
- SHA256 3f04441f96cf4107948e780872de14b6c828efa737a5e441a489124153002dea
- MD5 78de02c40b95774997646904e7002b59
- SHA1 0dde1c2e08641cfa3075d3f4f2a1a76b7a3e566c
- SHA512 343c94d15203c205e887c8e28da0f25940be7c28dca6201b17e211fc64d51e235509506babc142293d96c39b019ac598418b01f9c141108f78fcf5e2d521ccba
- SSDEEP 192:LwcY5Vu1nQM6gTnBC5gYsoj31GjncrY5YiKp3MLZpNBRi0R5GAzx/QhVv:8pg61GjcrY506LZVRxunv
- TLSH
  T1AC82325BD80C4801A5757793216B2209F669D3BF8DDA51EBB77A4E183F3187382BADC0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  Discord-Ddos-Bot--main/io-stresser.js
- Size 4KB
- SHA256 28abd4d291ecad27b96c8819c4c3b269c754954c8dca4e695f54dfdbca29bbb8
- MD5 205d6505a09e82b59c938ea4fac88c84
- SHA1 1640eba1e77ef970bd2650093bda25af78ac6000
- SHA512 876445a910cd899c4f11161354497e22599db1559469b0a4ff61ffaf41a3cacac5744f6e144d913d73f0f6670b641ff5839f8aa509d0a1c3c6ef48efe406946a
- SSDEEP 96:PMi+hin9Hg3uU3170uU31/5ZWk11VckAkH6iZh1Ubx:Ei+hOGlx0ljZVQdWUbx
- TLSH
  T1B2A1308AED181141927A3339E9F7551BF87ED22326418708BAACF1531FB1C2460D2FEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  Discord-Ddos-Bot--main/ll.js
- Size 3KB
- SHA256 23e2283f1a92830d351065edc14ce37fb30bff4385732f47df8a9a5c5792311f
- MD5 c4f87de3c084e9932c02812d3b304c04
- SHA1 d882103a2c92b05a8eae09180a25ae42236cc4a0
- SHA512 15da18d2b88271c92572361910f7842dee6de65745c88b11da4bb29579a31a5a0801ed9f3182aa071e1507d04ac7bd480588ef00143ffac503a8e2f7be962b98
- TLSH
  T10181BB08A8F9205067B77079BC5B010A2679C313354419247CDCB9968FAAD78D9C3AFD
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  node_modules/extend/README.md
- Size 2KB
- SHA256 b1ab983f31e157d431d53cabbc4491346a4f29aa5a12c54aa99be17e6e4d4456
- MD5 3713ff0e94ce6e5890204833b6b33898
- SHA1 25aa925ed3ef4f533976a45cece2cc8159993783
- SHA512 64655b1dc807def3f03f0d3e55e10f122c1cfb1f9aa5104b450db84761088c32856e4a26454cc6ff0f2f210b733efb31a7145a2ef535d616478b14feec0a1c2f
- TLSH
  T1485187A61200E3B31F5385D5FD2BB1DDF609706EE0A5702948DED2DCF1648224AEE16B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  node_modules/extend/index.js
- Size 3KB
- SHA256 b4879ec38a11a2458846788b91be630e6b1d06eb07f9515adc1ff9030af0b00b
- MD5 112b852c4237b335bba0aa2d32817474
- SHA1 21ecd848815af34edd426bcdafa52bf13c02be59
- SHA512 aa80341db9d9df6dc4b41750f42d85ac1c62de2dc012fc19d0f065272265ae7fdb3e379ea1e504e5eb8397f5e7d30c88f79a3e58d9f433d819e0210ccef393ba
- TLSH
  T1286133C1E77C92E941A2B1D0181D654BD63CA5B3683DE4D6BF888AFC349046EC1BA43F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  node_modules/extsprintf/jsl.node.conf
- Size 6KB
- SHA256 de090db13d60d252415a585d4ecc3af72af76a60de0d53425e0bfb5f4e5d5a87
- MD5 6e441b5d2a8aff9853740f378699b0b3
- SHA1 7197578b829d6c93d8356bf114c7f3d26722ec0b
- SHA512 77ba0c155ffe0cc78fa3b23c04779aa4ca941593dbde0973734674d3ea3469ee9b520f2bda2eee5519685835e2c021221ae18d552ad76c7ff8b5f04d271f62d6
- SSDEEP 192:WmlHslLr1q5D/B47VMllpkw1ZU9SZhlE/w6k/HOGtbb7fk:WOl/BWapkG+oP6kvOGtbb7k
- TLSH
  T13FE19423E8A013B9004641A1917BC3E5AE44426317C034DDB9ACC5AC27AAF74937B7FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  node_modules/extsprintf/lib/extsprintf.js
- Size 4KB
- SHA256 62ed0f3f0d206dd1922b3d217e4bd5ade07bb3f51500bfd990a107c3ef9c3f08
- MD5 6e46785346df047ad183819f57e104fd
- SHA1 2331ac9de23b7cc92510c3ead98efa1a8a2de8f8
- SHA512 57bf52dbaec3c370f431f423b8e1466f86e2634de4137338e452b08b48d80bf6670a94cd86e7043cba6c9ca497f0db0d7b9f9caf3cc0feab7c9d7b36a262de52
- SSDEEP 96:8kSgsgCmTyEGZnzXGfxfePd6Dvg8DCDTQDvYD3MRhql7e9sVl:XTyZncWegZIXIl7e9G
- TLSH
  T14781B856C37C1147966301A9881D985C43FEDD6B22E8DD81CC86C785BAC0CEF8372F68
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  node_modules/fake-useragent/index.js
- Size 8KB
- SHA256 b17f756c5847c85e717f54a4bf4f50013154073ee6627d2d68dd94e4269fc3a0
- MD5 c2f8f8b0fb09524211bd917d7e6f9276
- SHA1 ab1e5ff19ade6181fa74a985e639e9b8ecf7ba78
- SHA512 b0bfd1c954178ccfcda97a52a700b46e22330fe13c217ed1881f1854f51f23d7fc2aff3134946f0f42b13e95d059b4116c53cb9fb639b9ec3e7a6a707ae9b70f
- SSDEEP 96:AVVzO6WVeWQlT3QtU/y0VxIVK/VcVoZPMYLVYCuA9VUO/VAXpEVwO0Z8VjnfXGmi:KSuRm4Fe
- TLSH
  T169024863C61148A461D40CC2216A709099DA437FD6DA31E7FFAB0F606E9CAAF1577FE0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  node_modules/fake-useragent/readme.md
- Size 590B
- SHA256 472b510cb06caf940c6794fbd803537997c6e941c7ae8720d233ccd5ef20561f
- MD5 05a0be81cfea8e78a4aa6d5df972d1fe
- SHA1 6db0add7b7b696730bc912721da6431102be22eb
- SHA512 0afe6dde60665342c1fe9cbb63d91918eab6e6f209f814940bb7a88e8ee462d3c83cd835bcb7e74cf76bf4102af6a473c5f32b7833603b87e5a74d4e0cc80b5c
- TLSH
  T17AF0AC450DB9F032522141B4B43399B018E7B13A7018CE30F03C85FF88834DA05178DC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  node_modules/fake-useragent/test.js
- Size 91B
- SHA256 b0632f3b7f1de4105a23b3f40ce1820485f196f2b8299941a0fa40b5d47ce346
- MD5 2d62502f25bcea268006b397deb98b2e
- SHA1 ee55082d69893192aa6a65e429f410d5f787345e
- SHA512 f943d7f035b0d0c23810fd7c1dacc9e91dd76f512e0dc827286a2bb4bea5f9d145ae58550197d316b606bb7c44bf192fcb1a57692bf9c84cb6a231c8252660d2
- TLSH
  T153B012C00EECD10830200100D5112C017029C43055065A00F52C811705D0890052BC7E
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Contacts third-party web service commonly abused for C2

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32