9d39494cb45ef8df06a2c8feef7ee065dbf32d5bb84b545db4e41a3db013dc37

Sharing

Copy URL Twitter E-mail

General

Target
Discord Bypass.rar
Size 12.7MB
Sample260913-tlh64sak2v
SHA256 9d39494cb45ef8df06a2c8feef7ee065dbf32d5bb84b545db4e41a3db013dc37
MD5 8303eabac30be382e9fc5ffd947fb35f
SHA1 0a660bb489e2ee1053d84d2dca13c035e3e7ef9a
SHA512 d0ad425de0cd3fbc9259f411c9ef4a03d876a7536d43a26c6bd1ba8a24c896e91378e9129e60706db4b6545587b86c26362685201624d51183039d253bea4752
SSDEEP 393216:1KC7OYdDC1Q/2T5hXiO9+H+8N+lGY+UJAfkW0eXPO/pP:1ZO8p29lZYe8N+lbbWLXPO9
TLSH
T15CD633C4949265BE08ACBA50E41EE8AF35377E3102B5FC01A7B6E70C8DD44E6DB87D25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Discord Bypass/Release/Discord Bypass.exe
- Size 741KB
- SHA256 5b9bc349c05f90d1d993d25a7d9116e72e4e9e716b5836b477e9049046bd1a2b
- MD5 af2b6fcb510084e68aa5580f75cd28b8
- SHA1 6b5622d24362d6b3c23991149cead09614eabc9b
- SHA512 321a405165414540a130ff5979c276feb79d591e1712bd3a8c0f00d56a555a3859fe4f1408b30b463b0e50458cad13f415bf9b85c770d34cb5bdabb416f2cfe6
- SSDEEP 12288:7IIksN2TNBDQWeQcSJMKtPqP1fAPoMKxPUP37AQ:MIl2rxeQcwMKFCKoMKpWJ
- TLSH
  T111F4171477D04E82FDFDBAB592A5434086336B63959BE6880EF138E83865F504B07EDB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  Discord Bypass/Release/Setup Protector.exe
- Size 10.8MB
- SHA256 d52e90579a482f7030412a697f7f6da85d979c1dc49f2c12274fd9b7355a95f3
- MD5 40e279509e54a031dcf30ce9f0964cf5
- SHA1 c319c0fe77e07213d347a646e7218b8e30f5a487
- SHA512 4c7a72e5689180a1026941840490b9ba6c17685106bc81787bfeff29423d30da8af5f53d665b1ffe5030cbd4a90ba3561c44530d3ff8fb9ea73474222d42d307
- SSDEEP 196608:7a85DbJrteoY3pTgxqF2ZAYZIvf7DfyGR21X5Sp6GemDMPwMpRA+xWhpnPG/26Ib:W85vzJY3pUcF2rIvf7DfDspfaMPdpRkI
- TLSH
  T15BB63355E2900BFBD4F7A23A85C685443B23B87307A8D9CF43A087566F2B7D0693DE61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery spyware stealer persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral3 behavioral4
- Target
  MQWIEZR.pyc
- Size 22KB
- SHA256 c91ca09f1b49466e12dccd6592a7e95a7f95c14d2c0a2b22280d0a03bc56a7a8
- MD5 ee28a1d0ee6edd07541efeb734932a37
- SHA1 a1b7ef00ffdce29b4bb94b4f00cfcf04eb7b579a
- SHA512 ae8f57a774c3ea7c60c27f6f5a42eedea61ab2b238ae7bdce715f0f23cf3917821f7d2cb2146aa364e5f40c086c34e1a84a1fa7cdd4a00bdf5e2c1442ea55724
- SSDEEP 384:kOzc//OKbph/9m9bryFboQVjrMrH5qbjpuImKe4rr:ku4dp3m9brSboQBMrZqLl
- TLSH
  T1CCA208812B87C1BFF48893798842555F73FA88F4F611CB5372AEC0299E893253D664EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  Discord Bypass/SourceCode/MasonProtector/Builder.resx
- Size 250KB
- SHA256 31f49073a0249d5839d1393c2d99aa49d9fa32046076478333a2954d2b7f481e
- MD5 7f1ea4a5cd83b0295d549817e6f7a57c
- SHA1 70dc410113ed82a63a9a01c688fcb5038a64ddac
- SHA512 4ef5676fad4234f5139403136646fad76ba1b17ccb6c926a6eb1fa895f020b707d537d9e811ecf129b81cc64e20825458c79c93df0cc9ae32cc4f26d20c9d7ce
- SSDEEP 6144:Ka2jMnzocFzZwTCPPnpdScy8KAdfPfxN5v46gJQg:KaFnzocFzZwTC3niwpv2mg
- TLSH
  T19544DFB27CC2ADD13A39884653583E30FD1916E393186851B0CC6BF57FFA5F1A66D8A0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  Discord Bypass/SourceCode/MasonProtector/Properties/Resources.Designer.cs
- Size 1KB
- SHA256 7d6af7dcc4381899172e46df02756487cd5250d6aa6840e4928c5800ed04e271
- MD5 fb44b87276260311aca050411b36c10b
- SHA1 cea761b6248724fa2ca88c4285148b1f70a62f66
- SHA512 71f1f5cc802adb790901bb325bd9439b5057614544ea3289800577eeb4c07fdcd5a20cf61733bc1a83e22027382191d0e4aa8265e3cae7d59453ee4a45240878
- TLSH
  T11A3134FB13A9C5760835999FDA01F841CF565263C8BCA578B9DE00615FBB35043A9E2C
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10 behavioral9
- Target
  Discord Bypass/SourceCode/MasonProtector/Properties/Resources.resx
- Size 5KB
- SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
- MD5 0cd8c971317d19bbed44757809bcb92b
- SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
- SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
- SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
- TLSH
  T17FC11245B1C09D220BF3482DE6527988F7A8923B0235AC54B4DCA61F5F73C85A7B33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12