0409f2d3c5cda96547ad5a2a7d361e7b318d520f11cbfef9687da5d0eade69a2

Sharing

Copy URL Twitter E-mail

General

Target
Discord.Bot.Client.1.0.0.exe
Size 41.0MB
Sample260807-qrtm9awfjg
SHA256 0409f2d3c5cda96547ad5a2a7d361e7b318d520f11cbfef9687da5d0eade69a2
MD5 535d445dc5a852df3c42f93427ed61d3
SHA1 69d3ba9008707ae9427ccc03ce75aea7e842b954
SHA512 71e94b725bfd1541619c90ae588e6d3ab9fbf72e308741cc6bbccdaaa467167d0369f851455d1500b3ed269353b99cae5f875999c741a500b9b3688e23afa51d
SSDEEP 786432:lz+qD8SYqht9SQSdhWjNipptCi1qoHSESsqSlkcAeWWQDRW+r2NfqI7qiV6W7:lzbY69SQSdcjNEpkoHxSSlkLecdahZlT
TLSH
T1DB97333CF96B6425ECE58B3D06B011DABE58F192C0C595A3C33778E8A1B11123D66DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Discord.Bot.Client.1.0.0.exe
- Size 41.0MB
- SHA256 0409f2d3c5cda96547ad5a2a7d361e7b318d520f11cbfef9687da5d0eade69a2
- MD5 535d445dc5a852df3c42f93427ed61d3
- SHA1 69d3ba9008707ae9427ccc03ce75aea7e842b954
- SHA512 71e94b725bfd1541619c90ae588e6d3ab9fbf72e308741cc6bbccdaaa467167d0369f851455d1500b3ed269353b99cae5f875999c741a500b9b3688e23afa51d
- SSDEEP 786432:lz+qD8SYqht9SQSdhWjNipptCi1qoHSESsqSlkcAeWWQDRW+r2NfqI7qiV6W7:lzbY69SQSdcjNEpkoHxSSlkLecdahZlT
- TLSH
  T1DB97333CF96B6425ECE58B3D06B011DABE58F192C0C595A3C33778E8A1B11123D66DEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery defense_evasion spyware trojan
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Discord Bot Client.exe
- Size 90.9MB
- SHA256 83b03178e9753d65ea33e2911344863b832125c483246c524eee8dc1e6e989ed
- MD5 844c23a0a45cc4851554877c9a875606
- SHA1 aed6304b5e9a0dc3200a48d9417db785e7a217fe
- SHA512 91e1f5a73de94479228d6febcf763f882587c07111a1cbdd000b545d475463d1e5015ad400893565315309c63c41991753b0ac29099a78b5b3a3afef0dbd9567
- SSDEEP 1572864:222RDw4z9BOjvo+7r+o6TPB0MoA0qcVqxLHmWgRywF+zGMW1BGglD0flenjMsN59:2xDRRBqN7sBwfRt0fwfw+
- TLSH
  T1B228AD02A452617DE84731B2351DF73E9D20464B4B398FD7EB9C6CE12FB81E2263B646
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery spyware trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 4.6MB
- SHA256 508fc2e843a8385cb8ef874520ea097e5de752c3dbc040ed0525269cb05dbbc3
- MD5 87c025c61eabd6db771c0279d880c6a7
- SHA1 1d3797edecdc7ddc87ecb5ba09d87e18933cc9eb
- SHA512 56b1dc52ba3a3b277a1fcc84b9989cbd446636fa8f518c48d366642b48e252be9d86593027ecf5d1e00968cccafc4b9a8cd69178c0e8da52c538c85012e63f19
- SSDEEP 24576:woBBlmnLiLk8hrwrDK7QfkUW2wyfQlQuL:LblmLAFtuO80lr
- TLSH
  T1B136D56BBB49037306F282626B4AA4CAF31E903F375A1514346CD15C2B7B92583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 3.5MB
- SHA256 7d0d1290382ea0e44a3178446a0c202696237e27dbb5f8f0827691092b8f2228
- MD5 6bc4ada9a7cab72f49c564e6c86b4c3e
- SHA1 f0fba01542a0fbe585106f7efd884df65e8c89dc
- SHA512 d7ec39514c104b40a42cd3ca956ba84f5a78f237a39f40d85ba54983145bce2dfbc7ec5e0cbc1bf8ab64d1d370371a7cba5e30202d2c1f37782db32486ed7f6e
- SSDEEP 49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
- TLSH
  T1C0068D21FE018072E8CB01B265AE7F6A947C5730477451C351D4AEE6EC706E36F3ABA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  ffmpeg.dll
- Size 2.5MB
- SHA256 6f14dbd131f63e5904e33a91a3327550dc97d563404e46d0cadc606ebf0cc020
- MD5 d318f43c91f115e99d7a4afa4c8c49e2
- SHA1 6004360df806aef965f16522efe37c80ee82e953
- SHA512 7313bd2d9771028e0c2d824b3714fe71616621e87d2221b44473d291a6c7dc15a138feeee99685ba7d165b01d5f4c25df2cffb5db80b572af1859e526a4fa9ac
- SSDEEP 49152:OoGczDsBJ8dn9bns4eNvgmWf6c02RKPRwhzAHGl:tGpBedpn/eZeSc02R3hzAH
- TLSH
  T1FEC5BFC176617839C0464034657DE2BBBD350A3993128DDBCAD4ACB8AFB5EC244B972F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 307KB
- SHA256 06a83c0ed8efe8a43294ed91b589036f27c4fee58967837e8ba9797c8b81de85
- MD5 d83e9a76a8f910da9f5e8232545212bf
- SHA1 99bd81a462eaaeb23d4bc62c3f5049a3722ca788
- SHA512 53d7bd07826cba69b2dc2be7137ed693f534f40c3ffc2339fa2f10190afbcea9f0a41fb747cabff46d443815cc9ecac071c9f99f7961e7e1f8ddede188255330
- SSDEEP 6144:yTTgvMwzSYScE4hyjW18aLl4zaczYD9l001hlIitcyoOZumdb38VE/9Zk6M:yTUvMwztSc1NLl4z2pl001LbDoOZumdj
- TLSH
  T168649E00B980C036D55E04347628E7794A3EBE614FA1C9CBD7A44ABD4FB16D09B39B6F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 6.5MB
- SHA256 5625c7ac31923c4bb77e8a33b589706a2de5b1fbf032267301ae7bad7dab8278
- MD5 1bb8994654f62692cdc243a54c451358
- SHA1 05e8069e01db17906ccd1064eb17a420e2d929cc
- SHA512 5caccbc4ad4bd66d80b2358d2b94d7590d2dfcd5f289bd5d0f7c807ff0a553feff518ee53fb2c9e9d9d711d9fa762f8d89794624055d10a4d3fbe78f7a6db8ad
- SSDEEP 98304:8p0YUYugQYEiKdKti5ksNSMG9WIOAx9DfwzdvKKwFX6fYINCMoQ:GugQYE8i59NSZWRA9Df+dvlwFgCP
- TLSH
  T10A669E01A190952BD40B52745B1EB72DFB345A4A1C60CB87EB9CBDA87FF12A03B4725F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  resources.pak
- Size 4.6MB
- SHA256 ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c
- MD5 d9022282a7fbf3aa354559ab6a9c7926
- SHA1 ff1f2b77d80848bc1a51e48c21a033eb57d8776c
- SHA512 6b9ab157cf8e10d8a79ea2ad4e247210fe2a7fd75dab086eb55951d4e028af3060e1f42175be936c6b093abc2c3071c0fd1c45afee3c567a79e1b722fe5f5d97
- SSDEEP 98304:aAVqybB1h8fawgGMLdWiz1Z/de8xJtHDgAQcchH:aA4ybnhjwYdWm1iovjgAQcchH
- TLSH
  T10C2602193AEA2231C423B179AF8F6150B7398007321AE9B4B9CC97941FD653452F6FF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar
- Size 210KB
- SHA256 76b509211b64c83522028be4b5626444f5e1654376540193aa44ba9936454c3e
- MD5 8312f4af409fd95d9605ab2ae2ecc522
- SHA1 40ef23ec3cbc77af3ae5ce557d48d7e2d071f732
- SHA512 59e253be18b706978b57235eb47130e845308cb7ccfdcdf4ad51b716caec51364e7436c5cd5decb94b0dfd7806a979d7bf0038452028079f97156562e060fc51
- SSDEEP 3072:CFqYGisoDfnWEHcbmrhDQkF/BphkxeBphkxNBphkxD:C/5sm38bmtkkF/axeaxNaxD
- TLSH
  T1AF243C92FFAD713303E121B49D5678CFA33C8036359998B5BC9C84B829D546CC3B5E9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22 behavioral23
- Target
  swiftshader/libEGL.dll
- Size 325KB
- SHA256 1ee05c4c7549f8384eaa6306a5a6efc22faf683354e8240eaec8c17d8f980280
- MD5 12ea215487d10e6855cd9cc171f8c297
- SHA1 e4d1e88e684ef25938df4eb4f2b23411e74892bf
- SHA512 6d219a453b110e5505a1c01765b3eb3f140e8ce8f24006626679fc1e9be226e7a49b3d620c114292a28d11722a9b7acb24c6765242f729331f113461934b2806
- SSDEEP 6144:MH8fxwzcDrVQRN+9s7kbi1bDJ6Kv/PLj+ZHcq5RdZKtmpLul4+:o8fxwAXVQRQ9s7kvKjj+ZHcYTimpLul4
- TLSH
  T1C7649F00B940C03AD15E01307518E7794E3EBE615EA1D9CFDB984AFD9FB11D0AA267AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral24 behavioral25
- Target
  swiftshader/libGLESv2.dll
- Size 2.9MB
- SHA256 34f7ae8e30ec3dfc67927341b3cb0a88b226b6ac6c6f006a43d828e6d8248c9d
- MD5 7f748878bf48f3595d37877092d77612
- SHA1 b7eefb46fcac9ac6da0d611b6c1773f6d94883f0
- SHA512 8149bbc21b9d0b4540028f0fd88310e9cf35c29e8a1e0c4ea4ed5a062732f489090760464c297d95f2ce4b8212e98f3ad9d0744078b1b2abe4a52d3b174ccfa5
- SSDEEP 49152:WVXVY1923C/oQKE6YGu6BKi1dpx8+xDGjKwH8TiHWA/Zbl2BOPVrOcyevibtQw3C:WVF823CQQKKw3uCbDo9OvnzBzu3QL5+/
- TLSH
  T116D55D0167717839F4834372274D73B95A21E731247E99A7E69598F8AAF0CF0B22F607
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  vk_swiftshader.dll
- Size 3.5MB
- SHA256 5f64e196c10031af294a9bcf49e4e25fbbc4c4adbcab1bff3983751bb32f4837
- MD5 4faaf730349a80bacdb8cf4ad84ceb2b
- SHA1 ecbb3f264017e5a450487bd44b3c89c283da77e6
- SHA512 b32e23ecc5b2d0a388e4378ca051fd471a5166a92f3efcc9c39a64a809942d8142a2d8e30b69dd2b0cb1828502c363b32044feb935b08435640020bb5172185e
- SSDEEP 98304:mpo5SeKoeqFaimS0Y166QIT5T2P3gOusEznEmA:0y3Koelvm66QOT2fgRG
- TLSH
  T128F56B02B760B035F48752B1230EABB59E70E725657E8597D688DCF86EB49E1720F20F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  vulkan-1.dll
- Size 539KB
- SHA256 fffc99fb509f918820853b27f1e4f48ec7581b7e1b56df054c99e29116043609
- MD5 db5aa6063625ff76f6b2f97d7a1f23f5
- SHA1 c1c07d86912cdb49198436421ade516c62d654d4
- SHA512 0fca19bc20f3236c67175562016dba025d7466724b0eebed9f44905fb43769f9d91459caa751ba256cf329f456ac56840aacde7c6ef890493fe5f369ef6c143e
- SSDEEP 12288:DgIZmgVNVNw/eR75Vq9YlXHMpFxYaqvKt/uY2mtNIx:DgsfNjAw5VqwspF+HQ
- TLSH
  T145C49E05BC90C07BE21D1131A618F735AB2E9A519B748CDB9BAC69BC4FB01D0367A35F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral30 behavioral31
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Checks computer location settings

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32