General
-
Target
1.exe
-
Size
231KB
-
MD5
55ede8f26c8c4e66cb0ce6f611d1cda9
-
SHA1
7afcbd679f67ccebfa2b187a864051c47dcff247
-
SHA256
85ec91cce58a9d18f5161164fa36f3c32ab4a133e331e30143026692824aae52
-
SHA512
6943227a873ed601fe2d81da7498b8a4323c525cead8a32ad35c9e51513cf50b99c2d0486e6da3463992db81b0cfdf280829cb4bb59e32c2ad32e1c3cd58a77b
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4wuqmn9GuBV0dP6aPKEb8e1m5Mi:joZtL+EP8wuqmn9GuBV0dP6aPTKF
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1281076930648608779/WTPCLKlUSsVyAb4kF16YFHDUj8d6tGfYo49bnQyv4nB9OiF8PqMnkR_ia-uPDoNoD4ZG
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1.exe
Files
-
1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ