DiscordCDNDropper 41ed808a -- cdn.discordapp.com-attachments Jvvlpovxdup-dat-fake-extension RepositoryTokenFilter injectlast System-Net-Sockets CreateDelegate token-filter Discord-dead-drop | Orta

Derin Analiz - Discord CDN Dropper | Tehdit: MÉDIO

Arquivo Kimligi

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229`
Tamanho	66,560 byte PE32 x86 .NET, entropi 5.45, 3 section
Teknik	Discord Dead-Drop - payload Discord CDN uzerinden indirilir

Discord Dead-Drop Teknigi

DISCORD CDN: Malware Discord ek dosya (attachment) olarak depolanip sunulur. CDN URL'si indirme kaynagi olarak kullanilir!

https://cdn.discordapp.com/attachments/1160855778916319336/\n1196248399096328242/Jvvlpovxdup.dat\n  ?ex=65b6f023&is=65a47b23&hm=[hash]\n\n  Jvvlpovxdup.dat <- .dat uzantisi (PE gizleme!)

Teknik Analiz

System.Net.Sockets <- socket baglantisi\nRepositoryTokenFilter <- token bazli filtre/dogrulama\n_Token / token / CreateDelegate <- .NET reflection/invoke\ninjectlast <- enjeksiyonla ilgili string\n\nDiscord CDN avantalari:\n  - Guvenilir CDN -> proxy/AV bypass\n  - URL imzali (ex/is/hm parametreleri) -> gecici erisim\n  - .dat uzantisi -> PE olarak taninamaz

IOC

SHA256	`41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229`
C2 URL	cdn.discordapp.com/attachments/... (Discord dead-drop)
Payload	Jvvlpovxdup.dat (.dat uzantili PE)

DiscordCDNDropper — Perfil do malware

Discord CDN uzerinden payload indiren .NET dropper. Payload Discord attachment olarak depolanir (.dat uzantisiyla gizlenir). CDN URL imzali (gecici erisim). RepositoryTokenFilter, injectlast stringleri.

Tipo de malware

Loader

Linguagem de programação

C#/.NET

Protocolo C2

HTTPS/Discord CDN

Sistemas-alvo

Küresel

Capacidades e comportamento

Payload İndirme

Süreç Enjeksiyonu

Modüler Mimari

Kimlik Bilgisi Hırsızlığı

Yanal Hareket

Kalıcılık

Anti-VM/Sandbox

İkincil Payload Dağıtımı

Lista IOC (3 indicadores)

IOC — DiscordCDNDropper

# SHA256
41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229

# DOMAIN
cdn.discordapp.com

# URL
https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat

Tipo	Valor	Nota
sha256	41ed808a203e53bf5ad402ddf8af2f4434a17e94ac58224231d936669fd0b229
domain	cdn.discordapp.com
url	https://cdn.discordapp.com/attachments/1160855778916319336/1196248399096328242/Jvvlpovxdup.dat

DiscordCDNDropper — Ver perfil completo →