General
-
Target
GhostGG.rar
-
Size
110.2MB
-
Sample
240330-3agctahf35
-
MD5
8acaf25715e8b6a7cfe0c8d2109627ca
-
SHA1
9e09e2b8649963e6a0bcc693a4fbd4ee860b928d
-
SHA256
9f77ba3c437c3f4e532b91bb6a35142e972bea79a5dd6c1e463e68464dd03422
-
SHA512
81bd25dfff1ab9c45821e18c0ea4b642bef9d139e96b6962d5d68a8352c19dd54de2c3d2fe4057ab2b9274821a54d43ebb2f0a1acbceb4c81fe51bf5c18dcd8f
-
SSDEEP
3145728:iU7ny3r/wq2wmc8j/OEqSdZYuaamBg+J0zD:f4DPs3drmi++zD
Malware Config
Extracted
umbral
https://canary.discord.com/api/webhooks/1204520841597952070/7-WcG2D56UFZYmSvx8_YC_44skWeAchZD9ZBMkE4IJFbeyI5tOHQUJ-To1gsMrXYb1dk
Targets
-
-
Target
GhostGG.rar
-
Size
110.2MB
-
MD5
8acaf25715e8b6a7cfe0c8d2109627ca
-
SHA1
9e09e2b8649963e6a0bcc693a4fbd4ee860b928d
-
SHA256
9f77ba3c437c3f4e532b91bb6a35142e972bea79a5dd6c1e463e68464dd03422
-
SHA512
81bd25dfff1ab9c45821e18c0ea4b642bef9d139e96b6962d5d68a8352c19dd54de2c3d2fe4057ab2b9274821a54d43ebb2f0a1acbceb4c81fe51bf5c18dcd8f
-
SSDEEP
3145728:iU7ny3r/wq2wmc8j/OEqSdZYuaamBg+J0zD:f4DPs3drmi++zD
-
Detect Umbral payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Blocklisted process makes network request
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-