Overview

overview

10

Static

static

10

8657233b83...2d.exe

windows7-x64

10

8657233b83...2d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8657233b83ae7fa42534243b618700431733bf4edc9d97864e250fa15d95592d

  • Size

    229KB

  • MD5

    24233839190b24bee9fb8442540bfbfd

  • SHA1

    ca3a499080cbef642d1ad8e677a82111df491a96

  • SHA256

    8657233b83ae7fa42534243b618700431733bf4edc9d97864e250fa15d95592d

  • SHA512

    7895bc79817bbe298970535e41ce9db9b11bbfd1fcfd32dd0346e48d6596130375d894d76c70c2bd45c154de131e5de74e4d86400f90d9b7ac52ae8cce819190

  • SSDEEP

    6144:2loZMD9EB1/SqctonEPfCqAOYiElX8k7J+btUgJB7j8e1m1DZ:AoZpdSqcwvOYiElX8k7J+btUgJB3w

Score
10/10
umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1194630702365429840/aYBh8s3kHmXGYN-FriKtEXI-QnFohAVTjeBMQZ0cR6pnGNsMR3D-7AkoFJPEFeTgmXEy

Signatures

  • Detect Umbral payload 1 IoCs
  • Detects executables attemping to enumerate video devices using WMI 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables containing possible sandbox system UUIDs 1 IoCs
  • Umbral family
    umbral
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 8657233b83ae7fa42534243b618700431733bf4edc9d97864e250fa15d95592d
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections