1f2c891aebd06070b70974a3b96aa88b9f72ba1658a363399f4079fd96cffef5

Sharing

Copy URL Twitter E-mail

General

Target
DiscordRamLimiter-v1.0.0-win-x64.zip
Size 142KB
Sample260718-cmc8tagw7w
SHA256 1f2c891aebd06070b70974a3b96aa88b9f72ba1658a363399f4079fd96cffef5
MD5 0e8b09d742d47748e2183d54fdce7f91
SHA1 242c610f550f2a70dbe7bd602b1387fa2cee9cb1
SHA512 b7c309431b24f32d8808599086c21885d1f11709ac4051db29f3793f4033f33351bb859c86dd838af89902bf176228a2aec0a4e00f74a7f630925c48063885dd
SSDEEP 3072:O6aVZrVqVuxzfB2ejAJTkVRV4haUqXPphenGBtR+Ds2Bm:OHTrVqVu5fB9EgkcPnHBtR+Dtm
TLSH
T17BE3135C1C54726B808B723CAA79E12E03E2E4D6659C2B900B402736DF871DAFF594BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  DiscordRamLimiter-v1.0.0-win-x64.zip
- Size 142KB
- SHA256 1f2c891aebd06070b70974a3b96aa88b9f72ba1658a363399f4079fd96cffef5
- MD5 0e8b09d742d47748e2183d54fdce7f91
- SHA1 242c610f550f2a70dbe7bd602b1387fa2cee9cb1
- SHA512 b7c309431b24f32d8808599086c21885d1f11709ac4051db29f3793f4033f33351bb859c86dd838af89902bf176228a2aec0a4e00f74a7f630925c48063885dd
- SSDEEP 3072:O6aVZrVqVuxzfB2ejAJTkVRV4haUqXPphenGBtR+Ds2Bm:OHTrVqVu5fB9EgkcPnHBtR+Dtm
- TLSH
  T17BE3135C1C54726B808B723CAA79E12E03E2E4D6659C2B900B402736DF871DAFF594BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence spyware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  DiscordRamLimiter.deps.json
- Size 445B
- SHA256 af0546c946a83a8d284d91e7589b3f4df7a2dce016372b95c8ba27398a0bbba3
- MD5 76f550779f0650e3f1c2848b890812c6
- SHA1 a792c886fa87216a4fb8b17157183d76def0ed45
- SHA512 17e9208a243eca43b0b14c12ed0aa9b9b4851695f9f34e39de664844df9a7f1047196544b2825ec2181abb14a69baca808b065d375f15577f79840d764ff89eb
- TLSH
  T141F0921AE2840D9300F523B1A8374792F63267239416388675BE941C4F77C57D410F7B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  DiscordRamLimiter.dll
- Size 66KB
- SHA256 6a1a31e76aec2a7621b1b766307b05cd7e22b8f025a2e7cf4d811b2679251e2d
- MD5 65586fc58e494814164cb3334216f7d6
- SHA1 e5f4b7b4d95e7a582e1b92fc8768cd4e234cfcae
- SHA512 02e230bae4f65b8a24736462b9f607bafd20d3951d7daf1184198a6486f19b71b3acba5f4908f09720b09e66520e97142ec51a932464066f1dd1ed58aa5e68f1
- SSDEEP 1536:UDPYsAglE45iw85xqVR51KOnZ6nm37IaKFgcuHLP6PgwrFQW:UDGGexql1KOnlIdg1rKFQW
- TLSH
  T18763B010276D4B27CBDF1B7954F21211AB3AAA6A7527EB9D288C40ACCC977534E503B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  DiscordRamLimiter.exe
- Size 186KB
- SHA256 ed1753409fc6afc26fe95f9b98c755db0335fc1bc090407afd3d5b2ef558f361
- MD5 1d0bedbe2edf98dd6c1bffceaeaf464b
- SHA1 c905cdf41073f6b5a0412adb5dcd545574be6153
- SHA512 9eb598eb22ca5950a771421045da34558a4550039901008d93b53df9689846583c57dec0bdeca4e4aadb84454e305a11dd26654ec237aae6fd2423a7016e02b2
- SSDEEP 3072:KlDJk88wN1QI7sxrYL1peQ3lOY9SkHNwmlgzaAT5/jgrMAFQq:uAIwxrI14Q3kYBlrsjgrF2
- TLSH
  T177145D13A7A811FEE1B7D678C9924901FB7378594B71A6CF07504EBA0F66BD09E39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
behavioral7 behavioral8
- Target
  DiscordRamLimiter.runtimeconfig.json
- Size 519B
- SHA256 96bc2946dff8790400d652ec7f8de7bb043e954980d59470c112788b68a1fbd3
- MD5 7e4444b5a3e3cea574693f055f944011
- SHA1 04dfc98aa994475e2803241a1d55bb4277dbb8da
- SHA512 2fd5e7ffd3b12c6962d3ed7d7b99fa09b870173623701690cc0237529c32b008e219e48818a0bc4b6962fba2e3d161b8fa8ce38c03467329b0ddc9e58ef0ae8b
- TLSH
  T1BFF0276ACA106DB708B933BAD52AC182EB30532B10041D52B5FC081C6F776B21111F95
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9