Benign Download

Loader.exe

Detects executables Discord URL observed in first stage droppersDetects executables referencing virtualization MAC addresses

SHA-25622edabf5bd6c9bd9709b7d2211ecb3bec98814974e34e5b7d332dd05c10a02e9

URLhttps://tria.ge/api/v0/samples/260917-cv6kbsge99/sample

MaleculeTh

Evidence

Detects executables Discord URL observed in first stage droppers 0xae50–0xaff0

⋯7 more rows
0xaec044440000312e30000000000000000000DD..1.0.........
0xaed068747470733a2f2f646973636f72642ehttps://discord.
0xaee0636f6d2f6170692f776562686f6f6b73com/api/webhooks
0xaef02f313534393935383737353633313531/154995877563151
0xaf00393835352f6675716234624547495a549855/fuqb4bEGIZT
⋯15 more rows

Detects executables referencing virtualization MAC addresses 0xb4a0–0xb5b0

⋯3 more rows
0xb4d071656d752d67612e6578650000000000qemu-ga.exe.....
0xb4e030303a30353a3639000000000000000000:05:69........
0xb4f030303a30433a3239000000000000000000:0C:29........
0xb50030303a31433a3134000000000000000000:1C:14........
0xb51030303a35303a3536000000000000000000:50:56........
0xb52030383a30303a3237000000000000000008:00:27........
0xb53030303a31363a3345000000000000000000:16:3E........
0xb540253032583a253032583a253032580000%02X:%02X:%02X..
⋯7 more rows