General

  • Target

    notivewareupdatedfinallylmao.zip

  • Size

    140.5MB

  • MD5

    0bbc4f6e55292d148a3ae76ac661ac60

  • SHA1

    9bff9de379db7aabf06ee2328272ac2b9f99f99c

  • SHA256

    cf99e9f82f94cbd4084f5696b539e89fce809dc3c8c5adb3327b2934d59b4b3c

  • SHA512

    7964ead312de019f2faecbbeb59c71460f42bbd4a3df269472c469c596e4542a565ead6aaf9b4a41d0671a233141a89d70461cba94ae50e71067cd5903923217

  • SSDEEP

    3145728:3J7OKLft+7f13LiDennNVp0jDW6QelJHS4bEKG4I:Z7O913OCp0cf4JGj

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1271602814673621004/7D4_U4w7YJOrOSo_A_9lhGtVrM501rZZgsOc-WgbhBav7ayXyW9yjaP-IuG3JVLnIOob

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 17 IoCs

    Checks for missing Authenticode signature.

Files

  • notivewareupdatedfinallylmao.zip
    .zip
  • ICSharpCode.AvalonEdit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Bcl.AsyncInterfaces.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Expression.Interactions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.Extensions.DependencyInjection.Abstractions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Microsoft.Extensions.DependencyInjection.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Notiveware.exe
    .exe windows:6 windows x64 arch:x64

    e136c78efac5157bdb78b75c07967d98


    Headers

    Imports

    Sections

  • System.Runtime.CompilerServices.Unsafe.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System.Threading.Tasks.Extensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • System.Windows.Interactivity.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • bin/Ace/ace.html
    .html
  • bin/Ace/js/ace/ace.js
    .js
  • bin/Ace/js/ace/ext-beautify.js
    .js
  • bin/Ace/js/ace/ext-code_lens.js
    .js
  • bin/Ace/js/ace/ext-command_bar.js
    .js
  • bin/Ace/js/ace/ext-elastic_tabstops_lite.js
    .js
  • bin/Ace/js/ace/ext-emmet.js
    .js
  • bin/Ace/js/ace/ext-error_marker.js
    .js
  • bin/Ace/js/ace/ext-hardwrap.js
    .js
  • bin/Ace/js/ace/ext-inline_autocomplete.js
    .js
  • bin/Ace/js/ace/ext-keybinding_menu.js
    .js
  • bin/Ace/js/ace/ext-language_tools.js
    .js
  • bin/Ace/js/ace/ext-linking.js
    .js
  • bin/Ace/js/ace/ext-modelist.js
    .js
  • bin/Ace/js/ace/ext-options.js
    .js
  • bin/Ace/js/ace/ext-prompt.js
    .js
  • bin/Ace/js/ace/ext-rtl.js
    .js
  • bin/Ace/js/ace/ext-searchbox.js
    .js
  • bin/Ace/js/ace/ext-settings_menu.js
    .js
  • bin/Ace/js/ace/ext-spellcheck.js
    .js
  • bin/Ace/js/ace/ext-split.js
    .js
  • bin/Ace/js/ace/ext-static_highlight.js
    .js
  • bin/Ace/js/ace/ext-statusbar.js
    .js
  • bin/Ace/js/ace/ext-textarea.js
    .js
  • bin/Ace/js/ace/ext-themelist.js
    .js
  • bin/Ace/js/ace/ext-whitespace.js
    .js
  • bin/Ace/js/ace/keybinding-emacs.js
    .js
  • bin/Ace/js/ace/keybinding-sublime.js
    .js
  • bin/Ace/js/ace/keybinding-vim.js
    .js
  • bin/Ace/js/ace/keybinding-vscode.js
    .js
  • bin/Ace/js/ace/mode-lua.js
    .js
  • bin/Ace/js/ace/snippets/lua.js
    .js
  • bin/Ace/js/ace/theme-celery.js
    .js
  • bin/Ace/js/ace/theme-template.js
    .js
  • bin/Ace/js/ace/worker-base.js
    .js
  • bin/Ace/js/ace/worker-json.js
    .js
  • bin/Ace/js/ace/worker-lua.js
    .js
  • bin/Monaco/assets/codicon.ff6b888d.ttf
  • bin/Monaco/assets/editor.worker.3080eea8.js
    .js
  • bin/Monaco/assets/index.e423a72a.js
    .js
  • bin/Monaco/assets/stylua_wasm_bg.944f0ccd.wasm
  • bin/Monaco/assets/theme.json
  • bin/Monaco/assets/vendor.ab00825a.js
    .js
  • bin/Monaco/assets/vendor.f8cb9218.css
  • bin/Monaco/index.html
    .html
  • bin/lsp/.luaurc
  • bin/lsp/en-us.json
  • bin/lsp/globalTypes.d.lua
  • bin/lsp/libwinpthread-1.dll
    .dll windows:4 windows x64 arch:x64

    68b87f12e325f15066ee7b5b103c8814


    Headers

    Imports

    Exports

    Sections

  • bin/lsp/luau-lsp.exe
    .exe windows:6 windows x64 arch:x64

    8aca763be965db93ac92d00c4f485038


    Headers

    Imports

    Sections

  • bin/lsp/main.exe
    .exe windows:6 windows x64 arch:x64

    4d0fb8dc9ee470058274f448bebbb85f


    Headers

    Imports

    Exports

    Sections

  • bin/lsp/main.js
    .js
  • bin/lsp/wow.luaurc
  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • chrome_elf.dll
    .dll windows:10 windows x64 arch:x64

    102416632d8fb8249793faa959295bbe


    Headers

    Imports

    Exports

    Sections

  • d3dcompiler_47.dll
    .dll windows:10 windows x64 arch:x64

    8235041cfd6fffb926142c2c78013446


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • dxcompiler.dll
    .dll windows:10 windows x64 arch:x64

    86379d9f4693f2aa059197611ab2ffc7


    Headers

    Imports

    Exports

    Sections

  • dxil.dll
    .dll windows:10 windows x64 arch:x64

    42e0b0387affe2aaa84bcec72eb74baf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • exploit-ui-kali.deps.json
  • exploit-ui-kali.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • exploit-ui-kali.pdb
  • exploit-ui-kali.runtimeconfig.dev.json
  • exploit-ui-kali.runtimeconfig.json
  • icudtl.dat
  • injector.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • libEGL.dll
    .dll windows:10 windows x64 arch:x64

    592e6e55d4fe33d1bd84e3b3016fe3b2


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:10 windows x64 arch:x64

    5585f5d849dffc51c08f9c2876f039ac


    Headers

    Imports

    Exports

    Sections

  • libcef.dll
    .dll windows:10 windows x64 arch:x64

    787e67fda97a478e5d761e8d1c62802a


    Headers

    Imports

    Exports

    Sections

  • ref/exploit-ui-kali.dll
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • resources.pak
  • scripts/test.txt
  • snapshot_blob.bin
  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:10 windows x64 arch:x64

    c6d5499631d983c25f3393a4b4b13399


    Headers

    Imports

    Exports

    Sections

  • vk_swiftshader_icd.json
  • vulkan-1.dll
    .dll windows:10 windows x64 arch:x64

    67082af88118249115fd5249e678e93a


    Headers

    Imports

    Exports

    Sections