Derin Analiz - Discord CDN Dropper | Tehdit: MEDIO
Archivo Kimligi
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| Tamaño | 66,560 byte PE32 x86 .NET, entropi 5.45, 3 section |
| Teknik | Discord Dead-Drop - payload Discord CDN uzerinden indirilir |
Discord Dead-Drop Teknigi
DISCORD CDN: Malware Discord ek dosya (attachment) olarak depolanip sunulur. CDN URL'si indirme kaynagi olarak kullanilir!
https://cdn.discordapp.com/attachments/1160855778916319336/\n1196248399096328242/Jvvlpovxdup.dat\n ?ex=65b6f023&is=65a47b23&hm=[hash]\n\n Jvvlpovxdup.dat <- .dat uzantisi (PE gizleme!)
Teknik Analiz
System.Net.Sockets <- socket baglantisi\nRepositoryTokenFilter <- token bazli filtre/dogrulama\n_Token / token / CreateDelegate <- .NET reflection/invoke\ninjectlast <- enjeksiyonla ilgili string\n\nDiscord CDN avantalari:\n - Guvenilir CDN -> proxy/AV bypass\n - URL imzali (ex/is/hm parametreleri) -> gecici erisim\n - .dat uzantisi -> PE olarak taninamaz
IOC
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| C2 URL | cdn.discordapp.com/attachments/... (Discord dead-drop) |
| Payload | Jvvlpovxdup.dat (.dat uzantili PE) |
DiscordCDNDropper — Perfil del malware
Discord CDN uzerinden payload indiren .NET dropper. Payload Discord attachment olarak depolanir (.dat uzantisiyla gizlenir). CDN URL imzali (gecici erisim). RepositoryTokenFilter, injectlast stringleri.
Tipo de malware
Loader
Lenguaje de programación
C#/.NET
Protocolo C2
HTTPS/Discord CDN
Sistemas objetivo
Küresel
Capacidades y comportamiento
Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı
Lista IOC (3 indicadores)
IOC — DiscordCDNDropper
# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
# DOMAIN
cdn.discordapp.com
# URL
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
| Tipo | Valor | Nota |
|---|---|---|
| sha256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 | |
| domain | cdn.discordapp.com | |
| url | https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat |