umbral | bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

Sharing

Copy URL Twitter E-mail

General

Target
bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e
Size 234KB
Sample240612-d9a8eazeph
SHA256 bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e
MD5 65e7b5e4dd86e66cddd279dced3c31e5
SHA1 5b1836bd0519a866848d5867b42c9182066109bf
SHA512 ccb978eddac4b06c992db66db63e08964f94181fb068c76281d5c6e13e69b85723a89780110f3a5fb7570a79ca24dff8d78270f13f1faa419a98715c1fbd3f14
SSDEEP 6144:tloZM9rIkd8g+EtXHkv/iD4WeANbYMTiqL9Y0hnT+Y8e1mki:voZOL+EP8WeANbYMTiqL9Y0hFI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1249603922847338587/DEY5Xr9R1aQvy3CvoiaXSP5jJfO5TpGj07lrnS_vZzUXZKj83-TpKHRAA1znmvBvCvvI

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Detects executables attemping to enumerate video devices using WMI 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Umbral family
umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

File Explorer

bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

.exe 234KB

bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e
MD5 65e7b5e4dd86e66cddd279dced3c31e5
SHA1 5b1836bd0519a866848d5867b42c9182066109bf
SHA512 ccb978eddac4b06c992db66db63e08964f94181fb068c76281d5c6e13e69b85723a89780110f3a5fb7570a79ca24dff8d78270f13f1faa419a98715c1fbd3f14
SSDEEP 6144:tloZM9rIkd8g+EtXHkv/iD4WeANbYMTiqL9Y0hnT+Y8e1mki:voZOL+EP8WeANbYMTiqL9Y0hFI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Umbral payload
Detects executables attemping to enumerate video devices using WMI
Detects executables containing possible sandbox analysis VM names
Detects executables containing possible sandbox analysis VM usernames
Detects executables containing possible sandbox system UUIDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

241294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

mscoree

dotnet