Derin Analiz - Discord CDN Dropper | Tehdit: MOYEN
Fichier Kimligi
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| Taille | 66,560 byte PE32 x86 .NET, entropi 5.45, 3 section |
| Teknik | Discord Dead-Drop - payload Discord CDN uzerinden indirilir |
Discord Dead-Drop Teknigi
DISCORD CDN: Malware Discord ek dosya (attachment) olarak depolanip sunulur. CDN URL'si indirme kaynagi olarak kullanilir!
https://cdn.discordapp.com/attachments/1160855778916319336/\n1196248399096328242/Jvvlpovxdup.dat\n ?ex=65b6f023&is=65a47b23&hm=[hash]\n\n Jvvlpovxdup.dat <- .dat uzantisi (PE gizleme!)
Teknik Analiz
System.Net.Sockets <- socket baglantisi\nRepositoryTokenFilter <- token bazli filtre/dogrulama\n_Token / token / CreateDelegate <- .NET reflection/invoke\ninjectlast <- enjeksiyonla ilgili string\n\nDiscord CDN avantalari:\n - Guvenilir CDN -> proxy/AV bypass\n - URL imzali (ex/is/hm parametreleri) -> gecici erisim\n - .dat uzantisi -> PE olarak taninamaz
IOC
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| C2 URL | cdn.discordapp.com/attachments/... (Discord dead-drop) |
| Payload | Jvvlpovxdup.dat (.dat uzantili PE) |
DiscordCDNDropper — Profil du malware
Discord CDN uzerinden payload indiren .NET dropper. Payload Discord attachment olarak depolanir (.dat uzantisiyla gizlenir). CDN URL imzali (gecici erisim). RepositoryTokenFilter, injectlast stringleri.
Type de malware
Loader
Langage de programmation
C#/.NET
Protocole C2
HTTPS/Discord CDN
Systèmes ciblés
Küresel
Capacités et comportement
Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı
Liste IOC (3 indicateurs)
IOC — DiscordCDNDropper
# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
# DOMAIN
cdn.discordapp.com
# URL
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
| Type | Valeur | Note |
|---|---|---|
| sha256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 | |
| domain | cdn.discordapp.com | |
| url | https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat |