General
-
Target
Launcher.exe
-
Size
495KB
-
MD5
398b7fccfa2d8fd240a5032a20e57200
-
SHA1
2e9bb06c985765930abd4d8e4734d48fc9db476b
-
SHA256
6c37b3d7cba096ed83d54a1c31ca265f79567e4b4b9339d1f07b18b5013182d3
-
SHA512
aef4ca14b00598603aab35dbb3f02a264007d3f14533c59fc6e5040f138f19c2d414de6fa62860ea91e5b80d8e57e2297c30bbc837a0bf15490a758d80ba4c4c
-
SSDEEP
12288:9oZtL+EP8jM1jfVeGJCMFXSy3l7JDhA/Nfg:LI8w1jfVeGJCMFXSy3l9lA/Nfg
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1255969637254959297/VOD56kR-Ym1Ir4C8x6A8OEDQbQ85zzijJbXyxuRUOY0BIca0X87o3yo10-ghBTV8HF3A
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Launcher.exe
Files
-
Launcher.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 266KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ