General
-
Target
Havoc.exe
-
Size
392KB
-
MD5
36e9a2e99f37e82fe3e2a364d2fba865
-
SHA1
b09efd3439561f7de7b04d62d6c580c5be3e9b78
-
SHA256
83f5f98bc4c0ba87b31259771f35c5822bca2185d90aae6fc174ba816625f1e0
-
SHA512
da94b2c19995991530b8395ec8fa7d12572bcbaaf94ee290c4d74da36ef91503d057368e0c3de8066a68fdce3ba2bef95b1c821754ab55e0226a6b1de73541dd
-
SSDEEP
6144:bloZMLrIkd8g+EtXHkv/iD4EAEuPLxCqV9QhTuOLXfb8e1muei1G:5oZ0L+EP8EAEuPLxCqV9QhTuOLLzTw
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1210097168828862514/qiMfB8pbI0VGmLbCJI5y8HimVnNMcTPgOOb0GXnBUBDvOTpqayQ7-E9CYaH-x55WGvwc
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Havoc.exe
Files
-
Havoc.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ