General
-
Target
mw3cheat.exe
-
Size
229KB
-
MD5
5db80fba380203c721409c1365704c43
-
SHA1
44bac65e76b5cdafbf484218601481e312a641cf
-
SHA256
a55cbe38899777a55cdece2e1671d7490fe23f70565ded61a204773d8a1d1e2e
-
SHA512
84d37a20299c04d27ea9949cd31b044f73cd4ecca3551678fd286ca92fd6c22b77c773142de053a1a6c810cdcfbdac34e8a71574022ce2099376eb28eb7b7ebe
-
SSDEEP
6144:lloZM+rIkd8g+EtXHkv/iD4Psue3iAfbodxUyzzqkQb8e1mt9i:noZtL+EP8Psue3iAfbodxUyzzqtyU
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1280335563387568138/vVcrjGXs8Mj6e1Q-qxwi6ThUirNYTobrVtGCqtsnn0FHOY2rPsJ3-LvhMY-KFj4gUH4f
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mw3cheat.exe
Files
-
mw3cheat.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ