General
-
Target
Umbral.exe
-
Size
227KB
-
MD5
2f2e5193e34d583f15f52c8d525a48a0
-
SHA1
971fdcf967c2017fa201b3d486ed80bb18eddf4a
-
SHA256
721411866b84150806598c6f5fb21630a8ed056537c6fcb16a77c821dba8a3af
-
SHA512
f766b15ccf10638d5912d737e66eecb04186f551f051e7bf829e935d3f54a54561f4d4b28b9ebfa271c6ecbf0dc929a8c8799f1d641dcb9adb196c8992482498
-
SSDEEP
6144:sloZMCrIkd8g+EtXHkv/iD4XaqElGELns+d42X3WRfKb8e1m1i:qoZZL+EP8XaqElGELns+d42X3WROT
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1188552018617454692/Ys33b81wwvtYZVdTd7UGFkhOaFzsPrUPOogtZfG3Yxcl65A7aU-XFsL2Gk3Np2-NTW1U
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Umbral.exe
Files
-
Umbral.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 224KB - Virtual size: 224KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ