TOOLSNXCLXN.rar
- SHA256 f94153cfeb4b7fa38c103aaf84d6d1deecb194291b974526a504ffbc2ce282b6
Password
nxclxn
General
- Target TOOLSNXCLXN.rar
- Size 75KB
- Sample240506-xdklrahc37
- SHA256 f94153cfeb4b7fa38c103aaf84d6d1deecb194291b974526a504ffbc2ce282b6
- MD5 778a012a322ef022737614cd88f1dd0d
- SHA1 fbb02cdbbb5c4ad16ed3fed11c7cb6138886935a
- SHA512 45a33e6b5cbea376883d4106707e8b51b7bf84bf2c7bbfb472383ac742f9a10f10041d3b7451fef8cabfdca9f0b25747097994d5285e12359f968ef69f46d7b4
- SSDEEP 1536:Ls/risPJt3idxIbbDoG3/bhY1GN10kxmRTes4rF7UH3t9zc1t:gpPfyd8+1GNqkxmRf4B7Ud9zs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
umbral
C2
-
https://discord.com/api/webhooks/1234683527757430874/biedJYdyCmt_WYbiwNuuaBRfXrktJzoSlJ2mgMw1oEF8LquTN45hRsh87zlXKAnoRDFu
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/TOOLSNXCLXN.exe family_umbral - Umbral family
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TOOLSNXCLXN.exe
File Explorer
-
TOOLSNXCLXN.rar.rar 75KB
-
TOOLSNXCLXN.exe.exe 229KB
TOOLSNXCLXN.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 1040523f9dac2fb0ff0b30e5996aea8a5c326e685bc3633e5ea14f443aba7919
- MD5 8628b9dd8871af6a292f3a6e08386eaf
- SHA1 54424a37b205150d43b419eafb3d7bcb3dbf0f29
- SHA512 cc4633141e35c707d56299e161ec1de13adc8a42c4f6ef874e4b9a7b5f44e543113f58b3f19610bef227676bc00e4ad643e4cdf6e2a6f2f2f4323c65fec805d2
- SSDEEP 6144:2loZMafOe1FzxtE8WdhQ3cbbxM8KDXqBVa07nIrvTuuupJ8eFJL4w:AoZnvzx3MbVM8KDXqBVa07nIrAJX
- MD5 SHA1 SHA512 SSDEEP
-
Detect Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
nxclxn
Minor OS version
0
Major OS version
4
Entry point
239806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
226KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ