General
-
Target
Umbral lock.exe
-
Size
230KB
-
MD5
1fa176bdb23068c2e19ef70129e08bf4
-
SHA1
dbd197d081d7cae7d4f78946e105d9adb781e702
-
SHA256
e17e5bbcfcc361a560c909e75723ea3e4efba21c83633164cfcb26a0d2f5c7b3
-
SHA512
cc474c855e8336d4fe61c78d195bc2b95223da1847824200f5c2382227c88709b4d4b43625a358d59a3de364baf2aa9b78897a49e737ea880b7e386407ce494b
-
SSDEEP
6144:FloZM9rIkd8g+EtXHkv/iD4oQuYVjgULwyD1Ac5dHb8e1mAdIi:HoZmL+EP8oQuYVjgULwyD1Ac5Jfdx
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1203065936089714719/KQhiZVEm_wiVFufqpB5tcU3BlesMUXdpiU9jkbNiMfebPaYIqlrI1te6swQoU6oxVJan
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Umbral lock.exe
Files
-
Umbral lock.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ