FreakyBrowse.exe?ex=670c18f3&is=670ac773&hm=3a26c3c7751649dfe642708c7308021483cb3a3e840a9d7ffd5fdf0ed02746be&

First submission 2024-10-13 20:39:02

File details

File type: PE32+ executable (GUI) x86-64, for MS Windows
Mime type: application/x-dosexec
File size: 1614.14 KB (1652884 bytes)
Compile time: 2024-10-12 20:09:13
MD5: a2728dfccca75072dd2f6c6a02617ee6
SHA1: aa020f7c57065194ede62167c8bcbbf810365c83
SHA256: 18fd3d91c083416b21f0706cdf2d0ff6b5209f32df3a408188a0e8039e41a534
Import Hash : 72c4e339b7af8ab1ed2eb3821c98713a
Sections 6 .text .rdata .data .pdata .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 7/77 VT report date: 2024-10-13 19:21:06
Malware Type 1 trojan

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXps://cdn.discordapp.com/attachments/1285738574150373429/1294736627880431637/FreakyBrowse.exe?ex=670c18f3&is=670ac773&hm=3a26c3c7751649dfe642708c7308021483cb3a3e840a9d7ffd5fdf0ed02746be& VirusTotal Report cdn.discordapp.com VirusTotal Report 2024-10-13 20:39:02

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x29f00 172032 2d9a342b9cea10af36a9defffc2a2fd763e338be a6c3b829cc8eaabb1a474c227e90407f
.rdata 0x2b000 0x12a50 76800 a85e6f89a8df0432507c449eed9d61f5e0f4dfc3 7d8a79a90fa5c5b73bd021bc6e643a1f
.data 0x3e000 0x53f8 3584 069fd3959f91e690643115a296bf21044144de01 dba0caeecab624a0ccc0d577241601d1
.pdata 0x44000 0x2250 9216 09c2a6d5404bc19e11f7eddad07a164b42b01ee6 181312260a85d10a1454ba38901c499b
.rsrc 0x47000 0xf41c 62976 795dba6bc473080415f0d0547e67f1f6a05b9b71 455788c285fcfdcb4008bc77e762818a
.reloc 0x57000 0x764 2048 d73caf6099972c4407ac22954a7454e922084dc0 816c68eeb419ee2c08656c31c06a0fff

PE Resources 3

Name Language Sublanguage Offset Size Data
RT_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x55a3c 1128
RT_GROUP_ICON LANG_NEUTRAL SUBLANG_NEUTRAL 0x55ea4 104
RT_MANIFEST LANG_NEUTRAL SUBLANG_NEUTRAL 0x55f0c 1293

Packers detected 2

Microsoft Visual C++ 8.0 (DLL)
Microsoft Visual C++ 8.0

Anti debug functions 6

GetLastError
IsDebuggerPresent
IsProcessorFeaturePresent
RaiseException
TerminateProcess
UnhandledExceptionFilter

Strings analysis - File found

Compressed
base_library.zip
Library
mscoree.dll
vcruntime140.dll
ADVAPI32.dll
USER32.dll
KERNEL32.dll
8python312.dll
COMCTL32.dll
ucrtbase.dll
GDI32.dll

Strings analysis - Possible URLs found 1

http://schemas.microsoft.com/SMI/2016/WindowsSettings

Import functions

Name Latest seen MD5
discordnitrogen.exe 2024-08-26 11:31:14 2db515aa4c8ba2b4e6878e7e0b550c8f
tac.exe 2024-09-23 16:57:06 8a35be4e0576e642603dc78f07f32a93
Software.exe 2024-09-24 15:24:04 66c1d33fa2373f9f734336b87f123e31
st3amBYluxy.exe?ex=670cd923&is=670b87a3&hm=9d7dba21c2a8ad22d47f3edba77c4617ddfb3d025ff473df74bdf2b60f0c68d1& 2024-10-13 17:33:03 23f733d217275847ffb11bf97827dae8
freenitro.exe?ex=670c1355&is=670ac1d5&hm=fe431b2f20f8cc958563e6e904e1c828290ba1470a54a6f82725608fa4784485& 2024-10-13 19:34:02 8c9efd9a2d9d55aad11203cc4e3c816d
nitrobuyer.exe?ex=670c445a&is=670af2da&hm=1f281fd80c98af4f9fd87d76a7cd35a3e597b77693d1a804430d0000615d585a& 2024-10-13 19:38:03 32554d2f5dcd9927b21b43dda85359c2
mullakka.exe?ex=670c4027&is=670aeea7&hm=c37458cb8f8dc2985499fcc5dd86600a1dda5f7a724709109a97ae24970f4d65& 2024-10-13 20:17:02 136c7ac634c84ad86c1c7340c9262116
distribution.exe 2024-10-14 12:45:31 2cf67f645897af37ea483ed1aa3b2790
Wahiy_swapper.exe?ex=670e299f&is=670cd81f&hm=d668cc4432184523e29c1a622634c90477a431b1b18691a624773cd7989420a9& 2024-10-14 16:52:04 8e77547b14323977331594025634d90a
worker.exe 2024-10-14 23:10:06 5f08961671234960517cefb9df7a8c41
Rv2_Nuker.exe?ex=670f7931&is=670e27b1&hm=22265025fa8bb5baf986ff9795b8348e2c4fa24d4f6cced287e52fcfb45bf1e7& 2024-10-15 20:10:02 b459e3a71f72a9ac8a725144d56d1168
hydra.exe?ex=670ef165&is=670d9fe5&hm=d1114b65b18c8fc6ac378cf57169ad9d4f23499ced8ea6fe3b1fe96461e38a98& 2024-10-15 20:12:05 d446fa000d260aa78513d383874d82e5
Exela.exe 2024-10-15 21:10:21 83154f0731104f82b198eb13465dfa57