General
- Target https://cdn.discordapp.com/attachments/1375505666495479820/1524150923398746142/client.exe?ex=6a4eb3a9&is=6a4d6229&hm=211f2e51729ffba0c01b33226e6d7412c7ae3e560ef2b04840697a88e5941e83&
- Sample260707-zbdrjad12s
Score
8/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1375505666495479820/1524150923398746142/client.exe?ex=6a4eb3a9&is=6a4d6229&hm=211f2e51729ffba0c01b33226e6d7412c7ae3e560ef2b04840697a88e5941e83&
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.