Behavioral task
behavioral1
Sample
Celestial Crack.exe
Resource
win7-20231129-en
General
-
Target
Celestial Crack.rar
-
Size
82KB
-
MD5
4447904b4f7f87494ca0e8c45e39fe7c
-
SHA1
e165f1c86faf372e3915e395125c058b4d2c9a6e
-
SHA256
4ee620778e0fc3d0f875b64c11175f5cc3a79ffbe8515b894b70992ea3d9666a
-
SHA512
03efc112f7310494bf17225d186bc0aed019e0f213f2c9a1a29f3ea362e8506af88ecd3662e933d905c2d35c1e53799f78cd735e50935837d2da0adbc3cb8c30
-
SSDEEP
1536:t+sSR5uVYF+y+hq6FqHN2S/dRULHqBriDLWe95+nmpej4CSuC1fcrGe9ksi+OfVe:AXcYF+J0P4LHYmF5+mpTCSuprMZ8
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1206841676761403392/a-EXM4ZgqGVoLpH8y_HtS3NpSRNJdgil-Bjsj6PKkODdz7P0NYYCWytw3rW6XOOEGkgq
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/Celestial Crack.exe family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Celestial Crack.exe
Files
-
Celestial Crack.rar.rar
-
Celestial Crack.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Прочитай.txt