MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DiscordTokenStealer


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e
SHA3-384 hash: 6e2623f634af8c271131bcbd64661c9ff6c6fff2e8b76dc1256e2b76c62660aa45ebda5c34f391b806906c1a46a0be80
SHA1 hash: b36ae3b57f07bbfce698027a6e14ee5a331f3144
MD5 hash: 0a6305a34dc79d625e78c0b893a32a4a
humanhash: enemy-echo-maine-maine
File name:Rechnung.bat
Download: download sample
Signature DiscordTokenStealer
Create hunting rule
File size:1'527'773 bytes
First seen:2026-07-21 05:52:24 UTC
Last seen:2026-07-24 12:46:48 UTC
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 24576:r/pIpyPl78WD0axcS6Lolly+KiGrt0C/I+8IjlRr:O
TLSH T18765CFDDD16E05C68C043FC9AC281AC75B6987728A74001937BFBE485FBB4BEC11ADA5
Magika batch
Reporter lowmal3
Tags:bat DiscordTokenStealer

Intelligence

File Origin
# of uploads :
5
# of downloads :
94
Origin country :
DE DE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/c009e034-2970-43ec-b588-3349a995be80/
Malware family:
n/a
ID:
1
File name:
Rechnung.bat
Verdict:
Malicious activity
Analysis date:
2026-07-21 08:30:20 UTC
Tags:
ip-check stealer rat rmrlx
Link:
https://app.any.run/tasks/b973c254-93d4-4dcf-bcd3-aa8885a38ef6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75485/
Detection(s):
SecuriteInfo.com.Win32.SuspectCrc.30050.1330.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5f093dbcffb2c48cb7a7ca
Tags:
obfuscate shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a file
Creating a process from a recently created file
Creating a file in the %temp% directory
Deleting a recently created file
Сreating synchronization primitives
Connection attempt to an infection source
DNS request
Connection attempt
Sending an HTTP GET request
Using the Windows Management Instrumentation requests
Enabling the 'hidden' option for recently created files
Reading critical registry keys
Query of malicious DNS domain
Sending a TCP request to an infection source
Stealing user critical data
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cmd lolbin
Link:
https://www.filescan.io/uploads/6a5f093c51b920655dc4975e/reports/ee95b914-9af3-4544-8c50-1ec6bcdf3685/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e
Verdict:
Unknown
File Type:
text
First seen:
2026-07-20T22:23:00Z UTC
Last seen:
2026-07-23T04:35:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e/results?tab=lookup
Result
Threat name:
Clipboard Hijacker, Discord Token Steale
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945636
Signature
AI detected malicious Powershell script
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Creates a thread in another existing process (thread injection)
Found large BAT file
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Installs a global keyboard hook
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Obfuscated command line found
Sample uses string decryption to hide its real strings
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Rare Remote Thread Creation By Uncommon Source Image
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious PowerShell Parameter Substring
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected Clipboard Hijacker
Yara detected Discord Token Stealer
Yara detected LxBase RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945636 Sample: Rechnung.bat Startdate: 21/07/2026 Architecture: WINDOWS Score: 100 85 neuvo.ydns.eu 2->85 87 ip-api.com 2->87 99 Suricata IDS alerts for network traffic 2->99 101 Found malware configuration 2->101 103 Malicious sample detected (through community Yara rule) 2->103 105 17 other signatures 2->105 14 cmd.exe 1 2->14         started        signatures3 process4 signatures5 127 Obfuscated command line found 14->127 129 Bypasses PowerShell execution policy 14->129 17 powershell.exe 12 14->17         started        20 conhost.exe 14->20         started        process6 signatures7 93 Found many strings related to Crypto-Wallets (likely being stolen) 17->93 22 cmd.exe 1 17->22         started        95 Installs a global keyboard hook 20->95 process8 signatures9 115 Obfuscated command line found 22->115 25 powershell.exe 17 22->25         started        28 conhost.exe 22->28         started        31 powershell.exe 8 22->31         started        process10 file11 77 C:\Users\user\AppData\...\0u4muxxj34f.bat, DOS 25->77 dropped 33 cmd.exe 1 25->33         started        117 Installs a global keyboard hook 28->117 79 C:\Users\Public\271421645.ps1, ASCII 31->79 dropped signatures12 process13 signatures14 97 Obfuscated command line found 33->97 36 powershell.exe 22 33->36         started        40 powershell.exe 8 33->40         started        process15 file16 73 C:\Users\user\AppData\...\wv541glq.cmdline, Unicode 36->73 dropped 107 Found many strings related to Crypto-Wallets (likely being stolen) 36->107 109 Writes to foreign memory regions 36->109 111 Modifies the context of a thread in another process (thread injection) 36->111 113 Injects a PE file into a foreign processes 36->113 42 InstallUtil.exe 14 24 36->42         started        47 csc.exe 3 36->47         started        75 C:\Users\Public\1079513780.ps1, ASCII 40->75 dropped signatures17 process18 dnsIp19 89 neuvo.ydns.eu 94.198.96.165, 49768, 63921 ASSEFLOWIT Italy 42->89 91 ip-api.com 208.95.112.1, 49769, 80 TUT-AS-TotalUptimeTechnologiesLLCUS United States 42->91 81 C:\Users\user\AppData\Local\...\msasn1.dll, PE32+ 42->81 dropped 119 Tries to steal Mail credentials (via file / registry access) 42->119 121 Found many strings related to Crypto-Wallets (likely being stolen) 42->121 123 Tries to harvest and steal browser information (history, passwords, etc) 42->123 125 3 other signatures 42->125 49 chrome.exe 42->49         started        51 chrome.exe 42->51         started        53 chrome.exe 42->53         started        57 28 other processes 42->57 83 C:\Users\user\AppData\Local\...\wv541glq.dll, PE32 47->83 dropped 55 cvtres.exe 1 47->55         started        file20 signatures21 process22 process23 59 chrome.exe 49->59         started        61 chrome.exe 51->61         started        63 chrome.exe 53->63         started        65 chrome.exe 57->65         started        67 chrome.exe 57->67         started        69 chrome.exe 57->69         started        71 chrome.exe 57->71         started       
Score:
21%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e/
Threat name:
Win32.Trojan.Leonem
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 05:55:44 UTC
File Type:
Text (Batch)
AV detection:
7 of 24 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ze35aqepxdxytmamf66npbnn5ftscdpvpmgfueunevk3imoumnha._file
Verdict:
malicious
Label(s):
unc_dotnet_stealer_002
Create hunting rule
Link:
https://reports.threatray.com/28d426f2-7a4b-4eeb-8230-739db79b03c2
Similar samples:
51379f4acb028f106dff9e97d2fffe91ef2ed5eb377dfdafbe87b14d4f64044e
DiscordTokenStealer
b66775e5a6169599519e5b3e035bea6ca2824e14ad59662b9d43d356ba6b3c4d
DiscordTokenStealer
c8f4ceb5940e99ce6cd30cb9f67202c1d853b19d8f4c83882823d1647a2971d9
DiscordTokenStealer
f2796171d51454389ccb9d26a65794a030b1aaa80dbcb79a99153443c3151e40
DiscordTokenStealer
Result
Malware family:
n/a
Score:
  7/10
Tags:
collection execution upx
Link:
https://tria.ge/reports/260721-gk8n6aht8x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
outlook_office_path
Command and Scripting Interpreter: PowerShell
Executes a command shell one-liner
Suspicious use of SetThreadContext
UPX packed file
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Loads dropped DLL
Malware family:
ReflectiveLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c937d0408fb8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

DiscordTokenStealer

Batch (bat) bat c937d0408fb8ef89b00c2fbcd785ade967210df57b0c5a128d2555b431d4634e

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/75485/

Comments