Stealers.zip
- SHA256 6db216feeda9d8b54a69692b63c636e7c984aac8313b9b7cf599869bd9836a60
Behavioral task
behavioral1
Sample
Stealers.zip
Resource
win11-20240730-en
umbral
https://discord.com/api/webhooks/1222057832011137064/xHw2NG_dFhYqQKhgRobsja61tNIbEsN8GrE7S4K1SPmpvEek-9MvgREk8PUDX3-FoVeS
| resource | yara_rule |
|---|---|
| static1/unpack001/382f9d13e5a5945980c767ec1d98732d971a4e07bdb9ed1950d6c455edbb203a.exe | family_umbral |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/281af98214605dd037d87799144338941a62757daa794caa7dcc9529ec0fbdcd.exe |
| unpack001/382f9d13e5a5945980c767ec1d98732d971a4e07bdb9ed1950d6c455edbb203a.exe |
| unpack002/$PLUGINSDIR/StdUtils.dll |
| unpack002/$PLUGINSDIR/System.dll |
| unpack003/TamenuV10.exe |
| unpack003/ffmpeg.dll |
| unpack003/libEGL.dll |
| unpack003/libGLESv2.dll |
| unpack003/resources/elevate.exe |
| unpack003/vk_swiftshader.dll |
| unpack003/vulkan-1.dll |
| unpack002/$PLUGINSDIR/nsis7z.dll |
| unpack001/897d74e36e2f036d6e7b27d72c44816a6d59a4769d471c524112b95ba776def9.exe |
| unpack001/______ ____ ____.exe |
| unpack001/a96e053084a3d15d3392052ad1d09096fa51117c707beeefd3a00006461b892b.exe |
| unpack001/fae7035785c175dcad0c51146ce8c55fbf0d9f09380c2a20a52b4bdc67205030.exe |
Unsigned PE
Checks for missing Authenticode signature.
Detect Umbral payload
Unsigned PE
Checks for missing Authenticode signature.
Jul 26, 2024
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=4, id=14, version=7299,
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=175, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Unsigned PE
Checks for missing Authenticode signature.
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Unsigned PE
Checks for missing Authenticode signature.
Jul 26, 2024
count=2, id=257, version=30795,
count=146, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=60, id=261, version=27316,
count=1, id=260, version=27316,
count=30, id=259, version=30795,
count=222, id=261, version=30795,
count=55, id=260, version=30795,
count=1, id=256, version=30795,
count=136, id=264, version=30795,
count=1, id=255, version=30795,
count=1, id=258, version=30795,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=9, id=241, version=40116,
count=119, id=243, version=40116,
count=24, id=242, version=40116,
count=17, id=259, version=23907,
count=30, id=261, version=23907,
count=17, id=260, version=23907,
count=7, id=203, version=65501,
count=89, id=1, productName=Unmarked objects,
count=1, id=264, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=259, version=26213,
count=152, id=261, version=26213,
count=35, id=261, version=26706,
count=16, id=260, version=26706,
count=20, id=259, version=26706,
count=19, id=260, version=26213,
count=15, id=257, version=26213,
count=190, id=1, productName=Unmarked objects,
count=43, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=131, id=261, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=256, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=255, productName=VS2017 v15.9.5 build 27026, version=27026,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.9.5 build 27026, version=27026,
Unsigned PE
Checks for missing Authenticode signature.
Apr 11, 2023
Apr 11, 2023
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=259, version=26715,
count=160, id=261, version=26715,
count=18, id=260, version=28117,
count=22, id=259, version=28117,
count=117, id=261, version=28117,
count=20, id=260, version=26715,
count=19, id=257, version=26715,
count=214, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
Unsigned PE
Checks for missing Authenticode signature.