MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 13


Intelligence 13 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
SHA3-384 hash: 5f32607d263844ffc8838add4d1388f9add0d0f3093e097daabd5e88ceb21810322c7b63a14ca1b32b749b57e8c83825
SHA1 hash: cf039d54e6ea6c4dd9dfec27a728f52bcacd3eae
MD5 hash: f52844dbbbc909acf211c1ffcbc8f366
humanhash: six-neptune-white-chicken
File name:DiscordClient.exe
Download: download sample
File size:13'788'672 bytes
First seen:2025-06-18 20:11:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8104d624b3011ee87c03d7fc37d81968
ssdeep 393216:/hasDUlzFboTVIypQdgs1cvIXDHfPo3kOS6yjq4H7:pasDUl9IIyi1Cyj1
TLSH T11CD63396A2A411F6C46BD038815AE217F9B5B45A171086DB23E4C6B83F637F43FBD321
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter burger
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
485
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
DiscordClient.exe
Verdict:
No threats detected
Analysis date:
2025-06-18 20:11:42 UTC
Tags:
discord
Link:
https://app.any.run/tasks/c4eec227-ac58-468c-9550-1579beaae391

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10061/
Detection(s):
SecuriteInfo.com.PUA.Tool.VulnDriver.6.28710.18782.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6853ddfad1262bb4773b1bf4
Tags:
virus sage smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm base64 crypto keylogger lolbin microsoft_visual_cc packed packed packer_detected remote
Link:
https://www.filescan.io/uploads/68531db466c4b5c0b99a7e4a/reports/951d6282-eca0-4a78-8979-a40c7661d2e1/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
Malware family:
Khalesi
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c92673be-c202-420f-b0f9-24152eedf84a
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1717956
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Injects a PE file into a foreign processes
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1717956 Sample: DiscordClient.exe Startdate: 18/06/2025 Architecture: WINDOWS Score: 72 32 systemlocker.net 2->32 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 10 DiscordClient.exe 2->10         started        signatures3 process4 signatures5 48 Writes to foreign memory regions 10->48 50 Allocates memory in foreign processes 10->50 52 Modifies the context of a thread in another process (thread injection) 10->52 54 Injects a PE file into a foreign processes 10->54 13 svchost.exe 1 10->13         started        16 WerFault.exe 19 16 10->16         started        process6 dnsIp7 42 systemlocker.net 104.21.83.241, 443, 49736 CLOUDFLARENETUS United States 13->42 18 cmd.exe 13 13->18         started        20 conhost.exe 13->20         started        process8 process9 22 chrome.exe 2 18->22         started        dnsIp10 34 192.168.2.4, 138, 443, 49711 unknown unknown 22->34 25 chrome.exe 22->25         started        28 chrome.exe 6 22->28         started        30 chrome.exe 22->30         started        process11 dnsIp12 36 www.google.com 142.250.65.196, 443, 49745, 49776 GOOGLEUS United States 25->36 38 a.nel.cloudflare.com 35.190.80.1, 443, 49774 GOOGLEUS United States 25->38 40 6 other IPs or domains 25->40
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf/
Threat name:
Win64.Trojan.Lazy
Create hunting rule
Status:
Malicious
First seen:
2025-06-18 20:11:43 UTC
File Type:
PE+ (Exe)
Extracted files:
5
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rbejmfufa2u2eyn6li752gdprcrpcgawxgo6wzrwwe6mvl733tpq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/250618-yy42kael3v/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Sets service image path in registry
Stops running service(s)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/aecd4bda-410d-4c2f-9657-4a454d394177
Unpacked files
SH256 hash:
884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
MD5 hash:
f52844dbbbc909acf211c1ffcbc8f366
SHA1 hash:
cf039d54e6ea6c4dd9dfec27a728f52bcacd3eae
Link:
https://www.unpac.me/results/5a0bf162-56a7-4e34-bb49-0f045b888a3e/
SH256 hash:
3e6b136716ce2cf131d4f2c1da1d90d54526a26516da74e51156d0834ba1772b
MD5 hash:
1d2474566a6acd4b475f1575d0c8fbe3
SHA1 hash:
c9cbb43a76978a0ce807776164f6432b66bce050
Link:
https://www.unpac.me/results/5a0bf162-56a7-4e34-bb49-0f045b888a3e/
SH256 hash:
31f4cfb4c71da44120752721103a16512444c13c2ac2d857a7e6f13cb679b427
MD5 hash:
9ab9f3b75a2eb87fafb1b7361be9dfb3
SHA1 hash:
fe10018af723986db50701c8532df5ed98b17c39
Detections:
VULN_PUA_GIGABYTE_Driver_Jul22_1
Create hunting rule
PUA_VULN_Driver_Windowsrserverddkprovider_Gdrvsys_Windowsrserverddkdriver_31F4
Create hunting rule
Link:
https://www.unpac.me/results/5a0bf162-56a7-4e34-bb49-0f045b888a3e/
Parent samples :
262e636e1017d908369407ee3bfa69bde9201e2c98c20c1d85334be633764057
185d1aa9bff1b8f51d371e8b471011a4816e727603edd36844da7efc6183304b
7a976388b064594086b73e3e08a3b95b97a9eea7610bf9c4ac53a2d10304e12b
7b4ca5b780438bef6eca1d5241c5a5f9afbed7e9eacc62300c5ac64fe9e1030a
cc921933142a27e5a98ed63bd2ca5323a53e083e8f9f7f5c15da1b85eac276f6
638bfb452ad5c2ce2bc9aab6a7dd65665b886d79abd1ce66e617d33781036764
7409f72c3bec45343af484f26fefee09ec591ddc2f87aaff261337209dcbedc4
884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf
4bf19e234784a69a8e42fa345a703af865dbf4b58342af810dc51d5d902211c8
2d3272c4e2daca9621f56b0724743c467a8a70cd30826b505bb7c3d3a1dfd482
cab05e6b1c523c1c04f1c8806bcb1f1a0e2418f8179f57db80aa1dc5cd939844
f2943a108d98faef6c3411f0ad1235f85f3196cff70cd7d48565c92d0a21d060
3a9fe422216a414d420cbd1e20186da127fb5be80d50f40ef7db6215b7feb2f1
ed980429e185979a8bf0e6f71c3d16b61e0845189dd18785dcd94163566e2f51
2bd7ca44d7dc856bc104eefb0a01f3779bd61224b16c03d56dee1bffc8c08581
cbb5470f103fe2ef9344dbd99f892fd31f687c62225abdfaa76d3eea8b36feb4
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/884896168506/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:erbium
Create hunting rule
Author:Michelle Khalil
Description:This rule detects unpacked erbium malware samples.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:signed_sys_with_vulnerablity
Create hunting rule
Author:wonderkun
Description:signed_sys_with_vulnerablity
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_VulnDriver_GDrv_5368078b
Create hunting rule
Author:Elastic Security
Description:Name: gdrv.sys, Version: 5.2.3790.1830

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 884896168506a9a261be5a3fdd186f88a2f11816b99deb6636b13ccaaffbdcdf

(this sample)

  
Link
https://144.91.75.2/DiscordClient.exe
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/10061/
  
URLhaus
https://urlhaus.abuse.ch/url/3568133/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateProcessA
KERNEL32.dll::VirtualAllocEx
KERNEL32.dll::WriteProcessMemory
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_APICan Execute other programsapi-ms-win-crt-runtime-l1-1-0.dll::_get_narrow_winmain_command_line

Comments