Discord Troll Malware

For the past few years, Discord has been a hub for spreading malware, and while they have done much to crack down on this spread, the problem is still prevalent. The malware I found today on the app.any.run was minimally malicious but showed how trojans could easily be downloaded and executed by unknown individuals using the discord application. Because of the nature of this malware and the disgusting imagery that it shows, I will be limiting the screenshots to code. Still, I will be providing the code, downloaded payloads, and everything used in the malware so that it can be looked at and documented sometime in the future.

The initial payload is small. A file called minecraft.bat is only 12 lines long. It downloads an attachment from Discord called minecraftcracked.jar and then executes it. It then runs rundll32.exe on user32.dll, calling UpdatePerUserSystemParameters.

minecraft.bat

Sha1: 2c8e1fef7cb658a82a79c8d63f427d77074f6d27 Sha256: 29ec5be083d89ba07fbdebf451709b3c1f8141790557984e5a513d0758f83c9a

mincraftcracked.jar

Sha1: cb8f50150230d8d384cae57f6d0e7d167da8efce Sha256: a18fe9977d6f99eaa9676cabf0994ad60a7f52a2b730e9b15f91ff4632b8ad85

Because of the naming conventions of the downloaded files, I can assume that this is a trojan of sorts. Using the tool JD-GUI, I was able to decompile the jar file completely. It was nothing more than a downloader of images. These images are then displayed on the screen. I suspect this was done to embarrass the unsuspected victim. The only thing odd about these images is that some are incredibly large. One is 16 MB and the other 17 MB.

I, therefore, had a hunch about them and using the tool binwalk, I was to extract a hidden QNX6 file system from one of the images. This was not mountable, but it was soon determined that this file system had been encrypted. No signature or key could be found based on my current abilities, and no further evidence of the running program shows that this file system goes through any decryption stage. This leaves only room to theorize.

This may be a first-stage attack, and this file system could have very important data within it, and a second payload downloaded could be used to decrypt and then utilize the file system in some way. I will hold on to the file system for further analysis.

Network Markers

Warning – Images are disturbing

File System hash

Sha1: 38c1e86cbb0c233cb7b69fee8e349f24895fa45a Sha256: 6ea285b06c606936277f7a7313fb74648043c53de6102c49fc5a3fb36cb47d6b

Tools Used:

Detect it Easy
JD-GUI
Visual studio code

Edit on Github.

Network Markers

💬 Comment: