4 ms·

The number of people on this thread who don't understand how prevalent the discord malware problem is stunnig to me. I guess I forget there is a world outside o

by _8j50 3y ago

The number of people on this thread who don't understand how prevalent the discord malware problem is stunnig to me. I guess I forget there is a world outside of infosec sometimes. Just google discord malware and you'll find plenty of writeups. cdn.discordapp.com, if you see anything that isn't actually discord connecting to that domain in your corporate network then it's most likely malware. Matter of fact, get your own open source stealer malware, github is curating a topic for it: https://github.com/topics/discord-stealer https://github.com/topics/discord-stealer I gotta make an HN submission for this lol.

bigDinosaur 3y ago
Please do. I had absolutely no idea Discord was used for this purpose in any significant way (although on reflection of course it is because what can be abused on the internet will be abused.)
0xDEAFBEAD 3y ago
How do these stealers work? Is the assumption that the victim will download and run an executable? If so, what's discord-specific about it?
- mips_r4300i 3y ago
  A popular one is indie games. An attacker will copy the entire game and distribute it on various platforms as if they were the publisher, and add a setup program - either a MSI or an all in 1 exe. This installer usually has a powershell scripting extension DLL. The worm's first stage loader is this powershell script. It works because the setup program already asked for administrator access, so the PS script runs as admin. First thing it'll do is disable Windows Defender. Then run a base64 encoded script as a command line arg to powershell as a scheduled task. And so on. Telemetry is sent back to the c2 about what AV was installed, and if it finds itself running in a sandbox or VM it will immediately exit. I haven't seen them using discord's CDN, but I'm sure some do. Redline seems to have a high amount of customization encouraged in its deployment. Each infection is a few megs of bandwidth, so if you're infection a lot of targets the bandwidth costs can be non trivial, hence using a CDN.
  - 0xDEAFBEAD 3y ago
    Interesting, thanks!
- _8j50 3y ago
  The stealers are spread some other way, discord is used as a place to send the attacker stolen info. Back in the day IRC bots were used in the same way. The recent discord change affects a different type of abuse though. The attackers upload their malware to discord and use the link to that attachment as part of the infection/dropper phase. Let's say you get a phishing link, a social media post such as on facebook,linkedin,etc... or a search result on google, malvertising,etc... then that lets you download the desired content except it's an iso,archive, lnk,etc... you open it and the file in it. Little do you know that triggere the infection where powershell, wscript, csc or whatever else is downloading the malware using the discord permalink, if it is any good it will still need additional unpacking and decrypting before it either settles in its new home on your computer or if it is a stealer, it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) , crypto wallets, api keys , interesting files such as config files, credit cards (again browsers lol) and more and posts that data archived using a webhook to the attackers channel/room and the malware will not even touch your disk before disappearing sometimes (reflective .net assembly loading, Thread injection,etc...) If you have relatives who are not technical, either make them use macos or turn on defender with tamper protection and cloud delivered protection and make sure extensions and hidden files are visible by default. Also change the default file association for js,jse,vbs,vbe,iso,7z,rar,hta,bat,cmd and I am sure I am missing more to notepad.
  - 0xDEAFBEAD 3y ago
    Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I actually don't know a ton about the Windows permissions model. If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? (I guess installing a keylogger could cause it to be detected by antivirus software?) Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? What are reflective .net assembly loading & thread injection? That's quite a list of file extensions! It seems like Windows is astonishingly willing to execute unwanted code. Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS.
jowea 3y ago
What even is the "educational and research purposes" of such a tool?

by _8j50 3y ago

bigDinosaur 3y ago

Please do. I had absolutely no idea Discord was used for this purpose in any significant way (although on reflection of course it is because what can be abused on the internet will be abused.)

0xDEAFBEAD 3y ago

How do these stealers work? Is the assumption that the victim will download and run an executable? If so, what's discord-specific about it?

mips_r4300i 3y ago
A popular one is indie games. An attacker will copy the entire game and distribute it on various platforms as if they were the publisher, and add a setup program - either a MSI or an all in 1 exe. This installer usually has a powershell scripting extension DLL. The worm's first stage loader is this powershell script. It works because the setup program already asked for administrator access, so the PS script runs as admin. First thing it'll do is disable Windows Defender. Then run a base64 encoded script as a command line arg to powershell as a scheduled task. And so on. Telemetry is sent back to the c2 about what AV was installed, and if it finds itself running in a sandbox or VM it will immediately exit. I haven't seen them using discord's CDN, but I'm sure some do. Redline seems to have a high amount of customization encouraged in its deployment. Each infection is a few megs of bandwidth, so if you're infection a lot of targets the bandwidth costs can be non trivial, hence using a CDN.
- 0xDEAFBEAD 3y ago
  Interesting, thanks!
_8j50 3y ago
The stealers are spread some other way, discord is used as a place to send the attacker stolen info. Back in the day IRC bots were used in the same way. The recent discord change affects a different type of abuse though. The attackers upload their malware to discord and use the link to that attachment as part of the infection/dropper phase. Let's say you get a phishing link, a social media post such as on facebook,linkedin,etc... or a search result on google, malvertising,etc... then that lets you download the desired content except it's an iso,archive, lnk,etc... you open it and the file in it. Little do you know that triggere the infection where powershell, wscript, csc or whatever else is downloading the malware using the discord permalink, if it is any good it will still need additional unpacking and decrypting before it either settles in its new home on your computer or if it is a stealer, it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) , crypto wallets, api keys , interesting files such as config files, credit cards (again browsers lol) and more and posts that data archived using a webhook to the attackers channel/room and the malware will not even touch your disk before disappearing sometimes (reflective .net assembly loading, Thread injection,etc...) If you have relatives who are not technical, either make them use macos or turn on defender with tamper protection and cloud delivered protection and make sure extensions and hidden files are visible by default. Also change the default file association for js,jse,vbs,vbe,iso,7z,rar,hta,bat,cmd and I am sure I am missing more to notepad.
- 0xDEAFBEAD 3y ago
  Thanks for the explanation! You write: >it grabs your browser stored passwords (never use that or login to chrome/edge!!! Or mix work/personal accounts!!) I actually don't know a ton about the Windows permissions model. If the malware can already install a keylogger at this point, doesn't avoiding the use of stored passwords just delay the inevitable? (I guess installing a keylogger could cause it to be detected by antivirus software?) Also, in terms of mixing work and personal accounts -- it's not enough to use separate browsers, I'd have to use separate devices, correct? What are reflective .net assembly loading & thread injection? That's quite a list of file extensions! It seems like Windows is astonishingly willing to execute unwanted code. Like, I'm struggling to imagine why I'd be significantly worried about a downloaded .js file on Linux/macOS.

jowea 3y ago

What even is the "educational and research purposes" of such a tool?