MALICIOUS (1) campaign cataloged at 2024-09-08(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2024-08-old-colourfulls¶
Once imported, the module attempts to download an executable, put into Discord directory and most probably trick discord to start it. The download link does not work any more, so it's not possible to say what exactly the remote file did.
Abuse categories¶
remote_executable
Downloads and executes a remote executable.
typosquatting
Campaign uses typosquatting.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
hxxps://cdn.discordapp.com/attachments/941400716956799106/942268626843619348/malveillant.exe