General
- Target DiscordApp.exe
- Size 66.6MB
- Sample260810-3qbgha1fkb
- SHA256 ebd715c7c72795e81bb9a97c4e7ff59969ddb7779c89e27478c6171abe3fa2c7
Malware Config
Targets
-
- Target DiscordApp.exe
- Size 66.6MB
- SHA256 ebd715c7c72795e81bb9a97c4e7ff59969ddb7779c89e27478c6171abe3fa2c7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/app-64.7z
- Size 66.3MB
- SHA256 08c9842e61cee1b4eeb5887de5eb6a74a9b9c80622b0e3ca01f8c5f5ea10dc67
Score1/10 -
- Target locales/pt-PT.pak
- Size 530KB
- SHA256 fcd194e5caf36be4958c559acbde4f28a957083bf2aceac893f9e5c9e65d8a95
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/ro.pak
- Size 549KB
- SHA256 06c6486e8a42b447a55bd789bf2bc794354fa4be062139481e4612550f16c755
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/ru.pak
- Size 902KB
- SHA256 996d93fc5524a467f3b96fbd4a33a3438bd0f1b7090a1981e8b2b1263476711a
Score3/10 -
- Target locales/sk.pak
- Size 566KB
- SHA256 7a1db23a5b4f8e4c7cbc80a832f4f4c33fe29e31d4ae78a814bd8ca85620968f
Score3/10 -
- Target locales/sl.pak
- Size 544KB
- SHA256 7235e631afff75cad9d25b2e5a0e74696ea6b7f4b2a05753331bbd719a0699cb
Score3/10 -
- Target locales/sr.pak
- Size 839KB
- SHA256 35e57d972a60e161f123a5783e67e250f5cae1f66a2c11b119c10b81c43bd03f
Score3/10 -
- Target locales/sv.pak
- Size 489KB
- SHA256 bcd070d70a4284fd3144bf37c5e56994ca3a69c8f65aa72a9231748b30210e00
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/sw.pak
- Size 515KB
- SHA256 eb96ab83e2e08e811928742590178e97454863bc581dd8574d6a644fd3c6615a
Score3/10 -
- Target locales/ta.pak
- Size 1.3MB
- SHA256 e213c963248c93fcb4b88b1a45936dda28a5fe39cc0428a16556c6d737fc9940
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/te.pak
- Size 1.2MB
- SHA256 8dd7d206379445bd9afa4e01ab986c439cf70841d080fca6e152b453e94fcc49
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/th.pak
- Size 1.0MB
- SHA256 a4c2c305aa9d3df52d988c4da2bda398e8ee81d320e9da1de7d4d366e826dbc2
Score3/10 -
- Target locales/tr.pak
- Size 527KB
- SHA256 39d36d6d82f2a0a602620368ba593c7aac2190e323d776c6a72fa5ea269cf62c
Score3/10