General

  • Target

    TOOLSNXCLXN.rar

  • Size

    75KB

  • MD5

    778a012a322ef022737614cd88f1dd0d

  • SHA1

    fbb02cdbbb5c4ad16ed3fed11c7cb6138886935a

  • SHA256

    f94153cfeb4b7fa38c103aaf84d6d1deecb194291b974526a504ffbc2ce282b6

  • SHA512

    45a33e6b5cbea376883d4106707e8b51b7bf84bf2c7bbfb472383ac742f9a10f10041d3b7451fef8cabfdca9f0b25747097994d5285e12359f968ef69f46d7b4

  • SSDEEP

    1536:Ls/risPJt3idxIbbDoG3/bhY1GN10kxmRTes4rF7UH3t9zc1t:gpPfyd8+1GNqkxmRf4B7Ud9zs

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1234683527757430874/biedJYdyCmt_WYbiwNuuaBRfXrktJzoSlJ2mgMw1oEF8LquTN45hRsh87zlXKAnoRDFu

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • TOOLSNXCLXN.rar
    .rar

    Password: nxclxn

  • TOOLSNXCLXN.exe
    .exe windows:4 windows x86 arch:x86

    Password: nxclxn

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections