umbral | 6f801049dc7c819dc80f015947962f47[.]bin

General

Target
6f801049dc7c819dc80f015947962f47.bin
Size 117KB
Sample240822-bqx7qa1dnb
SHA256 68df11ba8f6db56ddf29a0ef7ea38663342375e36abb0b2924fbc974acf7b15f
MD5 853dc1d674bff740ced2ada5a354973a
SHA1 8a5a3a20cdffe8b683491378a52c22744a769f9f
SHA512 8c78a8890763836f65540ef854e12cb2d719a50d2c90919084c55ab8986aa49d3d64031dd5e7c24f5e4af957dd730fe17a1634d2aee7fb607761dcba4adf23cb
SSDEEP 3072:riFj/DQH36H1Kirx/zCIQjEGKwOxYv5o46QlG8pnktILVw:GV/DA8RRCAHw4o5o4X4EsILy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1275502153837838398/YsNK27WH0DB0tFxyB1u1EnPy6G9b_ATzsOE7FchNRWK3nlsLiWCT8GNYqMeNW8lbxZ0v

Signatures

Detect Umbral payload 1 IoCs

resource	yara_rule
static1/unpack001/20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe	family_umbral

Umbral family
umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe

File Explorer

6f801049dc7c819dc80f015947962f47.bin

.zip 117KB
20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe

.exe 506KB

6f801049dc7c819dc80f015947962f47.bin

SHA256 68df11ba8f6db56ddf29a0ef7ea38663342375e36abb0b2924fbc974acf7b15f
MD5 853dc1d674bff740ced2ada5a354973a
SHA1 8a5a3a20cdffe8b683491378a52c22744a769f9f
SHA512 8c78a8890763836f65540ef854e12cb2d719a50d2c90919084c55ab8986aa49d3d64031dd5e7c24f5e4af957dd730fe17a1634d2aee7fb607761dcba4adf23cb
SSDEEP 3072:riFj/DQH36H1Kirx/zCIQjEGKwOxYv5o46QlG8pnktILVw:GV/DA8RRCAHw4o5o4X4EsILy
MD5 SHA1 SHA512 SSDEEP

Password

infected

20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd
MD5 6f801049dc7c819dc80f015947962f47
SHA1 427c1556b90aa70d3d1b3314bc88325ea30f4687
SHA512 d6dd99f5dcaa1717d36ab6f2ad17264416114b77750bfe90901f37bfabbd5ba2f54f43f356cf1e4db6376eb2b0a8850502ce6535f546c59799961241333bfe2e
SSDEEP 6144:uloZM9rIkd8g+EtXHkv/iD4CGYhfVeGJdMFXSy3v7Igb8e1mSiZ:4oZOL+EP8CGYhfVeGJdMFXSy3vZUZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Umbral payload
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

0

Major OS version

4

Entry point

238046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

6f801049dc7c819dc80f015947962f47.bin

20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

6f801049dc7c819dc80f015947962f47.bin

20a5f718e30ebf604171a2e6c7b57fdd3affb5d1b3845920c12543fc9e8337bd.exe

mscoree

dotnet