General
-
Target
Cheat.rar
-
Size
80KB
-
MD5
9e423431f76b9c8bca70c52f24b114b6
-
SHA1
b708c68d85a0ccda3f2e6d003f6e79510b1d751f
-
SHA256
988e18df0a992354434f712880cc3fc7b2037392736138be3b8758bd889065fb
-
SHA512
911101f81acae115e19cd6d18e48470e508ebb28d2d890493419244c844d9da38b4241d3fc27b4013a57d74982d07d2be28742f1ef27a3e2de826ae2b598408b
-
SSDEEP
1536:iEeuZoNt1RLvd2p4z7vQyxt19+8eeZfh/qz9jxbFjk8pn:iKiDvd2gvQyj199niz9jxBj7
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1269544483859599445/e2idHKRsjakk7thlYC4A6RFw8GsohFMmJRGGfCEcDvdxIcB5zC8g3vIMNBfMP0varopk
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/Cheat.exe family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cheat.exe
Files
-
Cheat.rar.rar
Password: 123
-
Cheat.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ