General
-
Target
SpotifySetup_1.zip
-
Size
89KB
-
MD5
c843df8ccdb72ea01f1ff9aaee4c22f9
-
SHA1
501d44fd5c722385c0fe04d73e84a613776e1801
-
SHA256
c98fbffdea0025424251bd06290e16cff271a44cf953bf9f0edb89cf286a4785
-
SHA512
058875d33bcedd41ac00969cf325178042f5b52ebc08fafb0d47b25c40c4e2755ccd286b510fc99f0102b75aaac825513ac5e8634eca95ed87e1c6e88ddf89f5
-
SSDEEP
1536:O21BrBVdynjf9Rfk7iv7V/QmPwFdZuHK23Izrdzpmp8yannGghdnohgAqH0CJOi2:xHMzQiv7RJI5iK2+rVphxVBLHtkdNiq
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1152434461644947496/5BRsHMIAee930BphveYnGR7RYSeLI0V-GnrYaC4A9qoqf_PxD-ojfQQMZ93VuPEq2wQJ
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/SpotifySetup_1.exe family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SpotifySetup_1.exe
Files
-
SpotifySetup_1.zip.zip
-
SpotifySetup_1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ