Behavioral task
behavioral1
Sample
b58eafa327d4fb65a156dd947ef01f40N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b58eafa327d4fb65a156dd947ef01f40N.exe
Resource
win10v2004-20240802-en
General
-
Target
b58eafa327d4fb65a156dd947ef01f40N.exe
-
Size
231KB
-
MD5
b58eafa327d4fb65a156dd947ef01f40
-
SHA1
45140af55394b97cfc2f2d94846a1bcba54a61a5
-
SHA256
20c0ffaba031d92ff2346793e00bb14595bc2700ed31566454bf642672f3a0df
-
SHA512
7a764ce2f9bdcda59ca91cd6764c1e80f86434ae6708f54ee33ed4e9519b348d33b3384cb228a29614a3524ce84d231486f2715b6b9eb7655ed9b78e69cf6bbb
-
SSDEEP
6144:xloZMLrIkd8g+EtXHkv/iD4FGvXKaL7W8e1m06i:DoZ0L+EP8kvjwL/
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1269631276319772763/o25bvKHZdNWIKlxwZsWuchve_kJF08coX85MF90b1jtfeac64MGlyO-HPhpTLv4moYHD
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b58eafa327d4fb65a156dd947ef01f40N.exe
Files
-
b58eafa327d4fb65a156dd947ef01f40N.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ