636ca927d625e3c1a60fdfe8a76e5954f2b6395c26e77527e360b4302805ff80

Sharing

Copy URL Twitter E-mail

General

Target
Discord_OSINT-main.zip
Size 75KB
Sample260709-rheneacv8w
SHA256 636ca927d625e3c1a60fdfe8a76e5954f2b6395c26e77527e360b4302805ff80
MD5 37f5c8e316d9a282d2f74842a37f52f6
SHA1 d5219dbaf20b4213e6c2cf7cac2d5871f81101b2
SHA512 301c962ebd264ec699541b574963cedd2ee6d53c5f2ea1d41eb8841bb96009597b98432c40357efcb0582e71f46b916be7b970b8830bb307f8fdd584d3ad7f7a
SSDEEP 1536:v4kbWPtiSrcrPUie8yWCoek6WQaG9gVQ9kSLwtvR:AkbciSrgPU9iQvKVQ9kSMtvR
TLSH
T11773BF1F52241C93C44866BFF4A22913D7ADD843150D0D3728DC99DC2D16BBAAF8BE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Discord_OSINT-main.zip
- Size 75KB
- SHA256 636ca927d625e3c1a60fdfe8a76e5954f2b6395c26e77527e360b4302805ff80
- MD5 37f5c8e316d9a282d2f74842a37f52f6
- SHA1 d5219dbaf20b4213e6c2cf7cac2d5871f81101b2
- SHA512 301c962ebd264ec699541b574963cedd2ee6d53c5f2ea1d41eb8841bb96009597b98432c40357efcb0582e71f46b916be7b970b8830bb307f8fdd584d3ad7f7a
- SSDEEP 1536:v4kbWPtiSrcrPUie8yWCoek6WQaG9gVQ9kSLwtvR:AkbciSrgPU9iQvKVQ9kSMtvR
- TLSH
  T11773BF1F52241C93C44866BFF4A22913D7ADD843150D0D3728DC99DC2D16BBAAF8BE6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Discord_OSINT-main/js_to_py_json.py
- Size 882B
- SHA256 71e2d1c27b28ba3890b66bf9701a0b75a0e4684d0d887bde0ddf0c852f2dbfad
- MD5 92b869955162439a8bd4c52cde8c915a
- SHA1 5b6b8332a861a89795926574d92c04242bf82edb
- SHA512 af3055e6ad12b2d162050fed50beee64bd65d855a128b6237f82dec13c8c494d211ce47e15dc7f3638b6aeff60c94282feae7dbb35e2a9cc630512b32aa956ff
- TLSH
  T195118E710559A23086F0030A0B396DF7E38564D77EE7001839AD96991FB24F081AD3DC
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  Discord_OSINT-main/main.py
- Size 3KB
- SHA256 38148fc35192546e188a64b524d597aae54e5e8ff24459c1cc9b528ba4689eb3
- MD5 4a822b2e1e4f7ef52778dad4d2be7bc5
- SHA1 9111277ba8ca4aeebfd03608d3ad2340211ba8e6
- SHA512 73182871cc0d74c1d0470c3ae2696fd30b8a98a1666c800af36d95a59f1e3b82cab2de277f0fc00043cfdca81655f018614159769b9a48cf5a9a3ddb79a8a5a0
- TLSH
  T1A1714033980C230506725AAC6CA1D501EB4675C3A3763150F7FC62692F3EAC2F9798DA
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  Discord_OSINT-main/modules/__pycache__/general.cpython-310.pyc
- Size 907B
- SHA256 810d65e22d1d9244adae217dab4365d81d3111e8cf747082dd11b89227520d1b
- MD5 1eb4ed03d1df9e466f27bf5d3726f810
- SHA1 7658c7f830eea088f4fbe612da7b05ed37ab0a9b
- SHA512 0dba3538fd7297a070a5d7fcdfff647388d26c97428fc332604d00b9a49147f338163bc7ec6dd95417923fa34f2c84149a1f5b000122b429a99202788d5fb5bc
- TLSH
  T1B811EF97445090DFF555F0B8F1A2463C9BCA63F0EF4E10628E2C204D1E40E20AEC5F84
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral7 behavioral8
- Target
  Discord_OSINT-main/modules/__pycache__/general.cpython-311.pyc
- Size 1KB
- SHA256 854df1c12cc0e4744e065b3226ecefb3f248c7df30e5a18e164f93319ff71eeb
- MD5 48fd3ba55da2ad5e9f68470548931b9a
- SHA1 3c1f71a6dab2a41a11d9b8d472297bdb4e542d28
- SHA512 e9637facdd4c372575ee703660488c6d25c1dc35419b9541b808a1950c91465589ce6148b443438bbb4c2b1793a0b2267c52a0c1f63b137d34ae0c3c7a75fd05
- TLSH
  T1A23141D6F761D1ABE510B6BEF062121BF755D2F49C54A3374E2D406C0E518289ED9CC8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Discord_OSINT-main/modules/__pycache__/general.cpython-313.pyc
- Size 1KB
- SHA256 d7534b9074f069dc76e6324ed6b18da4c57278b81fd57c8aa6e47b64b3e7ed6c
- MD5 d5c9af7e5f08c5c3b57639e078ad0749
- SHA1 700e9116c317267df6f9b7064d8f90499187252c
- SHA512 0e8237ee0ee1f677516cb1c6fd0dec3cd12f664e39e18dfc05e587a084f87f8ed0132d63f10209148cc41c157a345b04408ac53b4ebab760c77b49fbf572eb88
- TLSH
  T1A43171BB9211435FEE70D4BDF1FE44B8474A31A98C06932F5E2E017D08D2DA0ACC9B85
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral11 behavioral12
- Target
  Discord_OSINT-main/modules/__pycache__/github.cpython-310.pyc
- Size 4KB
- SHA256 c21fc7ad1689eb44bc07ec0849511be1651b344ea17059d9fce56ef9be4c5de4
- MD5 efd564d3e315affe6b97070c362fbcab
- SHA1 9e56f0ee276e191df02d2cfd29832533a59f8bbf
- SHA512 1cf0927d1713542ae3a17f18f3d1337ab18913052310c52149b703aa17e32ad5a28a7f991d7619c3884e5a8f7626a6995f068e29d41278ee4d029b4b7c1a3c2f
- SSDEEP 96:Mpdsh2eIwHHp59JQX8MsOXrKiH3ZjmSNk9sSKrBH+wBRDBZ2OWem:MA2efHJ5wXhsOmipm8H+wBRGOWem
- TLSH
  T164A1C6C296114F8FFC56F37470715A241666A3FB7F0186572A20840FADDDAC13917B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Discord_OSINT-main/modules/__pycache__/github.cpython-311.pyc
- Size 9KB
- SHA256 ffb0305618167009dadf7c4def736b8c00c9fabecae790b78d70cff72422cc5c
- MD5 057910e898484bceb4add3bf11d5b94e
- SHA1 f803a872431eed5a2619f5149a532e8ce6cf1f01
- SHA512 4175aa63a1dd39d07594fe1e45ffc4e9d5f80e787e9f32b54f7d780459c85a9342b3786d7da002505e12710f672aa4d6bbf5a2391ae9fcbb90efca03de2c78b5
- SSDEEP 192:DkaVWaVyH5h/kKVN2XGELkee3H9EIgg52lHLlyUF3:YyWaVyflvR2keO9D52lrwy
- TLSH
  T11012C5C1672DD57EF944B371E023270AB376C9F6A500CB132576807AAD99E443E19CEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral15 behavioral16
- Target
  Discord_OSINT-main/modules/__pycache__/github.cpython-313.pyc
- Size 8KB
- SHA256 78d49f6648b837f3d4b49d6fcc7034310198c3f3c85fe509f22056b1f9e0875e
- MD5 1d64dd7c3d5900ac8b9eb555acccd5f7
- SHA1 897d83d23dc2b1b1e1d72c7a636c766ddb874772
- SHA512 acb68bcc882e01a4027f78c1a0ccffc121ebef21a354160e03b793d0c19acf98985614d42e43fe518ab9657e15124dce8338e4a44b1c28dbf07f629cec1bdde9
- SSDEEP 192:1FUZGb9XHTFCNB+tPeWtATV1N0rPybCnqnlFZuCI6:bgG9X2WXmtL2f6
- TLSH
  T1E202E89AC4618627FE309272F1FA8900571D6ED7BF328713395F81392DCDB90F958A08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral17 behavioral18
- Target
  Discord_OSINT-main/modules/__pycache__/playstation.cpython-310.pyc
- Size 1KB
- SHA256 80164696c292864ebbef3686072816228f9f7a3149199366e7f8f2c0fb9b3e85
- MD5 ccc78504dcc65138684aa3b96126a573
- SHA1 73b8effccef79e0bf97b49aec4350de79c4513f3
- SHA512 039f05416ec1398a257eb4b0f7048f916ee36a062f0852b8b53b1c5d2732749a5996dae798d8475e621aa455a6a468a0b9183295e87b2b87960021bc9bcc5888
- TLSH
  T192218353860883AFC5EB6A77F8900B3451B1AAF4EB205076696D154D9C23764D3EFE0B
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  Discord_OSINT-main/modules/__pycache__/playstation.cpython-311.pyc
- Size 2KB
- SHA256 4a2fb71d8ec1eb866f00534a7995cff3d736cd592119980187f294d20f34d64e
- MD5 0ab17bc7b4710c6ec0791ed511ce636e
- SHA1 4a899dc5c1e99b37169617ac9c0f0e104ae8bfb6
- SHA512 35a771ffb42a8e1e721fb25060db2dc114b7bef574d7fb3f2acba51759d78729d1177660278e5270fe3e6c52f1d898900bc12a9f626f487f228a732478222f9f
- TLSH
  T1E55172826726C3FFFA4127B3E022252833B2E5F0DA60D363669C8168CD117386E95DCD
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  Discord_OSINT-main/modules/__pycache__/playstation.cpython-313.pyc
- Size 2KB
- SHA256 32a2af46b372761b46e93b74a81fa74ddabf42e39f994a46c83b35df297f5696
- MD5 62cfaf36fdc96ab9bb6b5eba665f1c5b
- SHA1 d70c2a4e13363228126eca399d36f1e372b93536
- SHA512 c64f532f0e9a76bb5ca87fb379592c63c15c3f239a1021a867f5c15d386fed86e00b74f28cc072fec688fa1167a4a2c0ab610796d2f6d5fafcf455d45ebc84c7
- TLSH
  T18A51A752A524C66ACF541A72E0981AB8D2BC5EF53492D1B3328E034CCCEF67CC6D830A
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Discord_OSINT-main/modules/__pycache__/spotify.cpython-310.pyc
- Size 2KB
- SHA256 faeb89e5e1fbc8587ab1dd8ab36c8ba4e186f176839fa819f93e55ae82074c60
- MD5 791b64810a7151a3c246f3c5539e28ef
- SHA1 c2a62db7dee9c695cb3aa85cc5e36fac83d5eea4
- SHA512 54169afba1c40a1f0dc8055f319da1db2a8665ca98bd67b3583e3167d5e706a521f159ec04ddabad5c0cf50fffb4abd25a3b1e03e10ba80a1a7501fe31be41cd
- TLSH
  T11241858BC104911DFDFBFAB96094063D4BB86EB4B18B36B32028415A9C8684C65E254D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral25 behavioral26
- Target
  Discord_OSINT-main/modules/__pycache__/spotify.cpython-311.pyc
- Size 3KB
- SHA256 6c4fdd5c15c3ccf7c6e217965084c5a79580e3f5746a4e4e5dccddaf8d462115
- MD5 1a987d804c2ce5d971f069b541563fbb
- SHA1 bde38177a0b996b549402d667b57db9e969a4426
- SHA512 e2097fef02ab2e66c3b884ea43479445f5447f3838b3abc34686a03ffb0ee54e67b7bd8f3d6e7f128441cbca2c527a86baad8ca832ea7a832e96d4c7c5333c28
- TLSH
  T13C81E6865729C13FF992B3B9A01726277360C9F0B1D5CB233569417D8D569143C726CD
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  Discord_OSINT-main/modules/__pycache__/spotify.cpython-313.pyc
- Size 3KB
- SHA256 3898b66f14d27c70568c72f7aff9c66b387a3a56260430d2870850ebff61c6f4
- MD5 8e96443974f750f8882fd25768770193
- SHA1 727e87f2e58b0ec6258fb03606b546f552861f64
- SHA512 26811bffc1f402209eea2dc403ccf4fb8f9a0241102b513e4e27beb5d6d11cb0431aa39f67fad5b309966fca062a8c5477e8cadc1af91f1673a29f07660cf4af
- TLSH
  T17971831F8544D144FFA5B0B8D0BC4229B3688AD6B89AE733790ED37C8DCBC5C984034A
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral29 behavioral30
- Target
  Discord_OSINT-main/modules/__pycache__/steam.cpython-310.pyc
- Size 1KB
- SHA256 a30a2c88139668cc16c8de74b7b1ad57eb6fdffba7c1df1cf6874b76bb28cf89
- MD5 4a6e583e0b276cb8d23a7876cc6d9189
- SHA1 2ca43a33791a0a1d4b9debe2e983932e02d79869
- SHA512 5fb15bcda6a7886af31882e7a9f00ae97c0e9ef8ebe1a3dd653ab6951c6333e4fda780ef648cf91f82f1801430ec7c613a7ae0e63df42e76284f1df057765259
- TLSH
  T1B2317543C820939FFB55F1B6E08B027F19F4E9F2F789A5352A4921D82C20C9566B4D0D
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32