General

  • Target

    Stealers.zip

  • Size

    123.6MB

  • MD5

    7ba08b247dc031331e59fc48eba4615a

  • SHA1

    d0727ddb6603199399076a4bc1c89900f2c91d43

  • SHA256

    6db216feeda9d8b54a69692b63c636e7c984aac8313b9b7cf599869bd9836a60

  • SHA512

    a192ca08aaf1f885f21cc69c16bf6dd4739cbc653065f870259300ebc8a7d108476684a6d9f3d977104aaefeafe81fe638e5ea50d65cd05e20eb34f44196027b

  • SSDEEP

    3145728:RVxSDWYmkr0AFXnnTeZ7OPkc3Dffo5GJyhpNsXnmef:vYDWG0AFXTTPkcL+GMnjk

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1222057832011137064/xHw2NG_dFhYqQKhgRobsja61tNIbEsN8GrE7S4K1SPmpvEek-9MvgREk8PUDX3-FoVeS

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 16 IoCs

    Checks for missing Authenticode signature.

Files

  • Stealers.zip
    .zip
  • 281af98214605dd037d87799144338941a62757daa794caa7dcc9529ec0fbdcd.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 382f9d13e5a5945980c767ec1d98732d971a4e07bdb9ed1950d6c455edbb203a.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 776b2fcdf75fdd0649730d0f9824530cb61899db8df0ba38e9bfb1a749dfaffc.exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • $PLUGINSDIR/StdUtils.dll
    .dll windows:5 windows x86 arch:x86

    7b79709c0d5576549eb261e3410f95f8


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/System.dll
    .dll windows:4 windows x86 arch:x86

    fc0224e99e736751432961db63a41b76


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/app-64.7z
    .7z
  • LICENSE.electron.txt
  • LICENSES.chromium.html
  • TamenuV10.exe
    .exe windows:5 windows x64 arch:x64

    cf2e00be8791789115f4817e296ec9f5


    Headers

    Imports

    Exports

    Sections

  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    8235041cfd6fffb926142c2c78013446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ffmpeg.dll
    .dll windows:5 windows x64 arch:x64

    14338d2168d869b1b53d66354179e8c5


    Headers

    Imports

    Exports

    Sections

  • icudtl.dat
  • libEGL.dll
    .dll windows:5 windows x64 arch:x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:5 windows x64 arch:x64

    b3384e5182b61c941805b07b7dc28efe


    Headers

    Imports

    Exports

    Sections

  • locales/af.pak
    .ps1
  • locales/am.pak
  • locales/ar.pak
  • locales/bg.pak
  • locales/bn.pak
  • locales/ca.pak
  • locales/cs.pak
  • locales/da.pak
  • locales/de.pak
  • locales/el.pak
  • locales/en-GB.pak
  • locales/en-US.pak
  • locales/es-419.pak
  • locales/es.pak
  • locales/et.pak
  • locales/fa.pak
  • locales/fi.pak
  • locales/fil.pak
  • locales/fr.pak
  • locales/gu.pak
  • locales/he.pak
  • locales/hi.pak
  • locales/hr.pak
  • locales/hu.pak
  • locales/id.pak
  • locales/it.pak
  • locales/ja.pak
  • locales/kn.pak
  • locales/ko.pak
  • locales/lt.pak
  • locales/lv.pak
  • locales/ml.pak
  • locales/mr.pak
  • locales/ms.pak
  • locales/nb.pak
  • locales/nl.pak
  • locales/pl.pak
  • locales/pt-BR.pak
  • locales/pt-PT.pak
  • locales/ro.pak
  • locales/ru.pak
  • locales/sk.pak
  • locales/sl.pak
  • locales/sr.pak
  • locales/sv.pak
  • locales/sw.pak
  • locales/ta.pak
  • locales/te.pak
  • locales/th.pak
  • locales/tr.pak
  • locales/uk.pak
    .ps1
  • locales/ur.pak
  • locales/vi.pak
  • locales/zh-CN.pak
  • locales/zh-TW.pak
  • resources.pak
  • resources/app.asar
  • resources/elevate.exe
    .exe windows:6 windows x86 arch:x86

    c3afe98a750f2d4f1ed5d2ac323cb5e0


    Headers

    Imports

    Sections

  • snapshot_blob.bin
  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:5 windows x64 arch:x64

    c6d5499631d983c25f3393a4b4b13399


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:5 windows x64 arch:x64

    49ed29c3ff417b26c7cd92ecc9b7dcb3


    Headers

    Imports

    Exports

    Sections

  • $PLUGINSDIR/nsis7z.dll
    .dll windows:6 windows x86 arch:x86

    2656ea25cde98f31a490513c2db04ae8


    Headers

    Imports

    Exports

    Sections

  • 897d74e36e2f036d6e7b27d72c44816a6d59a4769d471c524112b95ba776def9.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • 92528e479047de62b02c89b69e68f674f4a6b869921894985869ba9eb8e555d3.exe
    .exe windows:5 windows x64 arch:x64

    349ad6ed7592b66bc5d63a8931001fa9


    Code Sign

    Headers

    Imports

    Sections

  • ______ ____ ____.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections

  • a96e053084a3d15d3392052ad1d09096fa51117c707beeefd3a00006461b892b.exe
    .exe windows:6 windows x86 arch:x86

    2eabe9054cad5152567f0699947a2c5b


    Headers

    Imports

    Sections

  • fae7035785c175dcad0c51146ce8c55fbf0d9f09380c2a20a52b4bdc67205030.exe
    .exe windows:4 windows x64 arch:x64


    Headers

    Sections