DiscordSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
DiscordSetup.exe
Size 51.8MB
Sample261006-taf8dazz8m
SHA256 66a88cdfb3f734884b98891b1996824f55aafc565dd8d90c312c04a314b483ff
MD5 22acdc60d47c70f8f933ecb8428a6e43
SHA1 74bb3edeed297fed094e1678320140d2dd914537
SHA512 e4214acc80c248377b66434a50a145d91d925c3d6e89cbc2397cacd602083d2e1f479397e853d4e812c93414de6db366ba6a83ceb50682ae33d81c475ae47598
SSDEEP 1572864:N7W267HWaq/LdYR7Y0pO4W9Ur1YQlIeusOs7QNRuIn:N7Wn7Ihe7Y004YQeDsOs7QXf
TLSH
T18FC73385BAC67CD4DA9B4071CEB5B334611CFC291AB64CC63D0E13216EB61E27A3952F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

DiscordSetup.exe

.exe 51.8MB

DiscordSetup.exe

IMPHASH 94a80956fb8b69cac2d52c4f7435aa0c
SHA256 66a88cdfb3f734884b98891b1996824f55aafc565dd8d90c312c04a314b483ff
MD5 22acdc60d47c70f8f933ecb8428a6e43
SHA1 74bb3edeed297fed094e1678320140d2dd914537
SHA512 e4214acc80c248377b66434a50a145d91d925c3d6e89cbc2397cacd602083d2e1f479397e853d4e812c93414de6db366ba6a83ceb50682ae33d81c475ae47598
SSDEEP 1572864:N7W267HWaq/LdYR7Y0pO4W9Ur1YQlIeusOs7QNRuIn:N7Wn7Ihe7Y004YQeDsOs7QXf
TLSH
T18FC73385BAC67CD4DA9B4071CEB5B334611CFC291AB64CC63D0E13216EB61E27A3952F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

rat

PE Signature issue

Digest

8d:5d:0c:60:ae:11:07:a6:fd:02:11:b3:6e:bd:14:75:f5:8d:33:70:ff:bc:85:3a:b0:2b:6d:c0:a9:b6:91:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=5128862,CN=Hammer & Chisel Inc.,O=Hammer & Chisel Inc.,POSTALCODE=95008,STREET=Suite 1180+STREET=1901 So. Bascom Ave,L=Campbell,ST=California,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Oct 2, 2026

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

5a:4a:00:fc:16:46:57:db:22:49:9d:9b:1c:ab:a7:09:83:98:5a:31

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Aug 8, 2017

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

Serial Number

04:2a:b0:42:f4:27:0d:4b:cf:90:ec:03:3b:9a:1e:c5

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 28, 2016 - Mar 28, 2018

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

42851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\tmp\squirrel\-2031866428\src\Setup\bin\Release\Setup.pdb

kernel32

InitializeCriticalSectionEx FreeResource LoadResource FindResourceW SizeofResource LockResource CreateDirectoryW LocalFree CopyFileW GetFileAttributesW CreateFileW SetFilePointer ReadFile SystemTimeToFileTime GetCurrentDirectoryW MultiByteToWideChar LocalFileTimeToFileTime WideCharToMultiByte WriteFile SetFileTime CreateProcessW lstrcmpiW LeaveCriticalSection RaiseException EnterCriticalSection LoadLibraryExW SetDefaultDllDirectories GetCurrentThreadId DecodePointer FreeLibrary SetEndOfFile WriteConsoleW SetFilePointerEx FlushFileBuffers GetStringTypeW SetStdHandle LoadLibraryW GetCurrentProcess GetModuleFileNameW DeleteFileW CloseHandle GetExitCodeProcess WaitForSingleObject MoveFileW GetTempFileNameW GetLastError GetTempPathW lstrlenW DeleteCriticalSection GetModuleHandleW GetProcAddress VerSetConditionMask GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo ReadConsoleW GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleCP HeapReAlloc OutputDebugStringW VerifyVersionInfoW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError ExitProcess GetModuleHandleExW GetStdHandle GetACP HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize

user32

CharNextW DestroyWindow LoadStringW ExitWindowsEx GetActiveWindow MessageBoxW wsprintfW

advapi32

RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegDeleteKeyW GetTokenInformation GetUserNameW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteExW

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoCreateInstance CoInitialize

oleaut32

VariantInit VarUI4FromStr SysFreeString SysAllocString VariantClear

urlmon

URLDownloadToFileW

comctl32

InitCommonControlsEx

Name

.text

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51.6MB

Virtual Size

51.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DiscordSetup.exe

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

urlmon

comctl32

generic