General
-
Target
vvvv.exe
-
Size
227KB
-
MD5
064412f7742a570af4817b07ffc1da36
-
SHA1
5b2018f24d6d7dc4304598e332a4bd4d8683885b
-
SHA256
9e3e2baed467adc5d52d7e9fa9158937c4006aa8a2f9093f0562e569ba5a1782
-
SHA512
22c32df71079a1549e481068a0890442babfbb07d67519e9b880792a43522a82f44eb29ef0bcf99ef337af81cc0b0d1caa072e56b2201bc1911f5c6ba14453b4
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD4eqoSHdmOhUU9va6vyDb8e1mDZi:IoZtL+EP8eqoSHdmOhUU9va6vQmA
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1204001041151164457/58E_8BYTbBaL7TinEq1fpWbHhcPMLkT4TgEE7gNN2nbqFlJil4PT-CZHLYhATtVyr6XM
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource vvvv.exe
Files
-
vvvv.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ