Overview

overview

10

Static

static

10

bdbc624e4c...4e.exe

windows7-x64

10

bdbc624e4c...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

  • Size

    234KB

  • MD5

    65e7b5e4dd86e66cddd279dced3c31e5

  • SHA1

    5b1836bd0519a866848d5867b42c9182066109bf

  • SHA256

    bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e

  • SHA512

    ccb978eddac4b06c992db66db63e08964f94181fb068c76281d5c6e13e69b85723a89780110f3a5fb7570a79ca24dff8d78270f13f1faa419a98715c1fbd3f14

  • SSDEEP

    6144:tloZM9rIkd8g+EtXHkv/iD4WeANbYMTiqL9Y0hnT+Y8e1mki:voZOL+EP8WeANbYMTiqL9Y0hFI

Score
10/10
umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1249603922847338587/DEY5Xr9R1aQvy3CvoiaXSP5jJfO5TpGj07lrnS_vZzUXZKj83-TpKHRAA1znmvBvCvvI

Signatures

  • Detect Umbral payload 1 IoCs
  • Detects executables attemping to enumerate video devices using WMI 1 IoCs
  • Detects executables containing possible sandbox analysis VM names 1 IoCs
  • Detects executables containing possible sandbox analysis VM usernames 1 IoCs
  • Detects executables containing possible sandbox system UUIDs 1 IoCs
  • Umbral family
    umbral
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bdbc624e4c40d85f3927d8dc261ee069982728471bde7a245504c3e903f1234e
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections