aaf68328b2a72fe36a2da4936c265614aeabda7d5787a0e06c7c8aedc9fac00d

General

Target
DiscordUsernameChecker-3.1.0.rar
Size 19KB
Sample260802-zqcssa1gkb
SHA256 aaf68328b2a72fe36a2da4936c265614aeabda7d5787a0e06c7c8aedc9fac00d
MD5 48d1714ad72d40cd04b69cb43f39e48e
SHA1 cd62a11bfdc10ad5eab961267243f69b959ed44c
SHA512 94c7c4e67bb24151273a2a4f7ddb4171b1e7740450bc5d56a24582a599ecb5b64bf94dbf94a6e23dc1f6e19408f5a22029c7a8fc836c3f5975211515311d0ed6
SSDEEP 384:vPY604rpJG+JSatQ2fsN4F9UpCAWRMCOJo:Y60QpZAC5AYNO2
TLSH
T1A992D1E2611DD16A6A54A706C49EC71237D02D57F76F85492B8BEC0F7A8E01DEE0343B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  DiscordUsernameChecker-3.1.0/checker.py
- Size 11KB
- SHA256 b5df9547edb84d8d62503e2a7ba376d217d3b5598c825f966d62a49b1fd8ed5d
- MD5 6457278806e2fbd1331f817e1b843d45
- SHA1 0f085a39231b3608a948769ec1976ceabe0fd62a
- SHA512 c764b59011ee246cea11f40b7eb6e28bdddce01a3ad13431962abcba0935f4dca99570870f87f03f41e00317d9c49893be0a9c1d239d67fcae2d9e17da7cce13
- SSDEEP 192:q6Ml5ZDHNd8K+858crhw9kP0gkAL7JIolOn0zAj1wjNneKkdEmi:q6uxfynwW1MNnfkdo
- TLSH
  T18C3252369C250C31F6E6D95CDDA67321D660B5073E0028643ACCB2385FDC66A99BF9BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware trojan
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  DiscordUsernameChecker-3.1.0/config.py
- Size 6KB
- SHA256 4a19f1c316b689602428f108d7709a83776c1d1b8d824b31d5a303414fd93d2c
- MD5 79236e3ed0376f88ab3e4f7162bdf23a
- SHA1 33b622ff329918935973752d32672bf59e3034ba
- SHA512 5712b075b8a4161750fcce4c303b5e4c50b8bea20432e3055c5a1956e2bcf297fd8a8cd2866d20a6ab151a5bf2b4228b03ac2b747dfbe17b9bf686b51cb31fff
- SSDEEP 192:QiO+HphegIHOT6QYkl1T4/5urjwi1yjuqg:DO+JwmT44d
- TLSH
  T16CE17269ED214D2189A3CA738C53E113F64DFA930F0D1874B8BC81587F09569A5ECEF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  DiscordUsernameChecker-3.1.0/engine.py
- Size 15KB
- SHA256 a1adeb3a87706f4d136c0a1acbed15c661274a31df44ca190bd1a5c35d4a687d
- MD5 8295dc181a56850ffd231519ebd4bba0
- SHA1 2f3debcac15ac3705cdbd0b339ce282c3bfe2972
- SHA512 39c37d6641a34b2f7d5e20df0afa94f84258bbae3c72920c2c11d6d9dacd40ee56ad8955ebb7873d51a771eb312e4fe8910b9b9204337fa4d4af8f88a5fc1e9d
- SSDEEP 192:p85UtWDSpwaIPg1DiAgkJWQ21iWFTpjojTSiPfBPxbIFCoa7f:p8uwWpwaIPg1DiAH921ieTpjSTB
- TLSH
  T1E56286758C250D359AA7CC669D62B153E35ABC1B0E091438B6FC825C2F8D035CABDEED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3
- Target
  DiscordUsernameChecker-3.1.0/proxy.py
- Size 8KB
- SHA256 e90b261d8060b392dc3b6639cbc8bb446ea83b8bb429d1633edb92894a898681
- MD5 3fa40a373ccd51b73d34c007d4c8f255
- SHA1 a68745436c71b8c2a31670abbe9d964abc9bba68
- SHA512 0f4e9d41e2fccb4ed4831ff151944f070d530d5d765ca3bf0d4480f4f09395340a986dfd34d91ee3ca24ac22ef241c45d09f4481e924d53c9935fe80909db0b4
- SSDEEP 96:hvjEcK6rXsF8AUDitp9PAykGjkKuxCPJYEcT861IifzIrWAuWNKz:NEDiv+pnkKrPJhcT8uIifmWAuWNKz
- TLSH
  T1FA0233A5C5029D26E7BFC92A99E2A303771DA8571E0C21717CFC63282F1902992F4DFC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4
- Target
  DiscordUsernameChecker-3.1.0/run.sh
- Size 71B
- SHA256 c8a33a5e836d167cd2cd1b4862f4b43be869c52da1eff7aa069a5c6ab045de97
- MD5 b1d29f8bc95fa4d5407c1956864308b2
- SHA1 8fdc45e60a6e24d151998c0f4bd99d1f6d0372ae
- SHA512 63a7826a58e7ea0567aee9a99d940232f8433fc51fe69f95e27e9bdec56099fca06a646fe5f5b532b41bc6548463c89b6c2c2f754bcceeade75e4bf7240d8ae1
- TLSH
  T17BA024D51001CC410FD470400C00045004C5D5F717030C4151F00F07C5343C53443301
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5
- Target
  DiscordUsernameChecker-3.1.0/ui.py
- Size 8KB
- SHA256 dceb6d90600aca29c4ecd33186733fa3302011584b4911bbe14826d345955db7
- MD5 37966227c0e274f0ec67993b8623a60a
- SHA1 f3eb1309e4da44e0132b293eaa5dc46e71bebd9b
- SHA512 5ef1bb0fc366ecc9235baefeca0f3387e4c017c13d99101044d2b7d7bd734712ba6128a9fd77351b6088649553f6ff16582b072596f26432aab914bf709779f0
- SSDEEP 192:yRkAsBZr34p4zK3tLkeeNRrIxlGErGXdepeSB:ykfBF3232eeNRMTEepeY
- TLSH
  T1B702645AEC700C72F763C4219C97A852C61659132F5038B93D6C966C2F1E6BE907C6CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral6
- Target
  DiscordUsernameChecker-3.1.0/wizard.py
- Size 15KB
- SHA256 58960e9be272400fd44f4a6095b0b6a77cc86588ff60e410a53f6bb31fd134ce
- MD5 6e311f16fda3b7ebfef9a75679b236fd
- SHA1 ca4cb1af0dc6cd9dcb9987081826c0fcfdc4f4e6
- SHA512 44e126b8a72c56e751efcdd999ee2f51fa5b9512f6e8325c8c9b34cbb02952a601429ec20183965d73c6bcf5446515a4fae5b3c1c63139329865114c00512b6b
- SSDEEP 192:LRcTXLB10UYIZxVucjjA1RNnlX8Lk1jyHEUTCqWuZbM5MRuNMnPz42xJVahZYs2D:LRcTXLBmUGHxGkANWufShZYs2tJTUb4
- TLSH
  T1BD72A733EC111C2183ABD9A4E9A75147EA28F5071940F87579DCD2780FAC92A85BCFBD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7