General
-
Target
betaloader.exe
-
Size
482KB
-
MD5
f0463e89e4d196f296afb160224f63b0
-
SHA1
1ada6bf36121d08f96f4a09402774d3d5a065a7d
-
SHA256
d891136336eb391236b2cc2f6749440d9eb4dc8fc517eb1262cf739276657073
-
SHA512
8aacfd6f7c745d41bc639d90cb841652541ec17f7f745bd3ee9f2d24458b3b0c1a5d6b9d50a1e9a50a3e583841e4a443f8d930e626365bc729bff93d19528e34
-
SSDEEP
12288:6oZtL+EP8DWQVjgULgyD1Ac5H2xSY2RpX2ZrAyhteZN:+I86QVjgULgyD1Ac5HJBpX2Z3ts
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1254794965268299827/EE6SKfQhdH1VUguOzHvaA_cNjKMrNA7OYXHOMkNwJT_pYjMBf-9VvYMNTexyuwjEK14O
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource betaloader.exe
Files
-
betaloader.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ