DiscordCDNDropper
Discord CDN uzerinden payload indiren .NET dropper. Payload Discord attachment olarak depolanir (.dat uzantisiyla gizlenir). CDN URL imzali (gecici erisim). RepositoryTokenFilter, injectlast stringleri.
Tehdit Profili
Tür
Loader
Yazılım DiliC#/.NET
C2 ProtokolüHTTPS/Discord CDN
İlk Görülme2024
Hedef Kitle
Küresel
Amaç / Yetenekler
- Dropper/Discord Dead Drop
Bu aile için henüz C2 sunucusu tespit edilmemiştir.
Araştırma Raporları (2)
DiscordCDNDropper 41ed808a -- cdn.discordapp.com-attachments Jvvlpovxdup-dat-fake-extension RepositoryTokenFilter injectlast System-Net-Sockets CreateDelegate token-filter Discord-dead-drop | Orta
DiscordCDNDropper 41ed808a PE32 .NET x86 66KB. Discord CDN dead-drop: cdn.discordapp.com attachment Jvvlpovxdup.dat (.dat=gizli PE). RepositoryTokenFilter, injectlast, System.Net.Sockets.
Raporu Oku →DiscordCDNDropper NET_D3E0800E -- cdn.discordapp.com Jvvlpovxdup.dat Dead Drop Payload, injectlast Token Enjeksiyon Dize, RepositoryTokenFilter LoginPredicate Kimlik Dogrulama Bypass, System.Net.Sockets Ag Baglantisi | Yuksek
DiscordCDNDropper 41ed808a PE32 .NET 66KB. cdn.discordapp.com Jvvlpovxdup.dat dead drop payload. injectlast token enjeksiyon. RepositoryTokenFilter LoginPredicate kimlik bypass. System.Net.Sockets.
Raporu Oku →