Derin Analiz - Discord CDN Dropper | Tehdit: 中
ファイル Kimligi
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| サイズ | 66,560 byte PE32 x86 .NET, entropi 5.45, 3 section |
| Teknik | Discord Dead-Drop - payload Discord CDN uzerinden indirilir |
Discord Dead-Drop Teknigi
DISCORD CDN: Malware Discord ek dosya (attachment) olarak depolanip sunulur. CDN URL'si indirme kaynagi olarak kullanilir!
https://cdn.discordapp.com/attachments/1160855778916319336/\n1196248399096328242/Jvvlpovxdup.dat\n ?ex=65b6f023&is=65a47b23&hm=[hash]\n\n Jvvlpovxdup.dat <- .dat uzantisi (PE gizleme!)
Teknik Analiz
System.Net.Sockets <- socket baglantisi\nRepositoryTokenFilter <- token bazli filtre/dogrulama\n_Token / token / CreateDelegate <- .NET reflection/invoke\ninjectlast <- enjeksiyonla ilgili string\n\nDiscord CDN avantalari:\n - Guvenilir CDN -> proxy/AV bypass\n - URL imzali (ex/is/hm parametreleri) -> gecici erisim\n - .dat uzantisi -> PE olarak taninamaz
IOC
| SHA256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 |
|---|---|
| C2 URL | cdn.discordapp.com/attachments/... (Discord dead-drop) |
| Payload | Jvvlpovxdup.dat (.dat uzantili PE) |
DiscordCDNDropper — マルウェアプロファイル
Discord CDN uzerinden payload indiren .NET dropper. Payload Discord attachment olarak depolanir (.dat uzantisiyla gizlenir). CDN URL imzali (gecici erisim). RepositoryTokenFilter, injectlast stringleri.
マルウェアの種類
Loader
プログラミング言語
C#/.NET
C2プロトコル
HTTPS/Discord CDN
標的システム
Küresel
機能と挙動
Payload İndirme
Süreç Enjeksiyonu
Modüler Mimari
Kimlik Bilgisi Hırsızlığı
Yanal Hareket
Kalıcılık
Anti-VM/Sandbox
İkincil Payload Dağıtımı
IOCリスト (3 件の指標)
IOC — DiscordCDNDropper
# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
# DOMAIN
cdn.discordapp.com
# URL
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat
| タイプ | 値 | メモ |
|---|---|---|
| sha256 | 41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229 | |
| domain | cdn.discordapp.com | |
| url | https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat |