Resubmissions

17-02-2024 09:50

240217-lt6y5sde4y 10

17-02-2024 09:20

240217-la7rbsdg95 10

General

  • Target

    Nightmare primordial.rar

  • Size

    301KB

  • MD5

    0db08fb61756fd21c1f5ef57f6efb558

  • SHA1

    2738f7aee9bfb561a8de01f3791e2cd366731075

  • SHA256

    76b918c2381bcf640fd178c6adf290dd67be20861b7bac8c253fa87a34b09c9a

  • SHA512

    206db77485338b38d757fc88abe136ecf3ddb91b3f3b14f7455304ec0545cc97917e560d46f8c438b0a2343907cf7102c8507eeada8b00a5658f203524fc47fc

  • SSDEEP

    6144:jUke+abRp2dRG0f4fm/Bb4zbfQ6Maw19kjNhtKti2pXTFUnoP9b2wxG:jK+abxXoYQcjNhstNpXZoIxG

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1120806695107575818/w934Ho43pR02N99efviWvvl0z2bdnFX1GmqAH_KAKHc-anmIPAWpGFkq0QyTT_J0xwGc

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Nightmare primordial.rar
    .rar

    Password: 1234

  • README.txt
  • primordial beta.cfg.cfg
  • primordial loader cracked.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1234

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • primordialV2.dll
    .dll windows:6 windows x86 arch:x86

    Password: 1234

    f9c6cb3add798c4967ef04e6ed11d107


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • zuruland.lua.lua