Behavioral task
behavioral1
Sample
bruteforcer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bruteforcer.exe
Resource
win10v2004-20240802-en
General
-
Target
bruteforcer.exe
-
Size
231KB
-
MD5
1e2b102dcdabbee48cd1308fba1f6719
-
SHA1
b657cdb68bb499c81f3746965ce63db8b8da7017
-
SHA256
27fddb3ad83e8139d32ec09c8d6790b0ddd177c2e90f84f104c64010f91e4401
-
SHA512
7e46052ca1abddd8fc993034cca84fe5d0752629d571a1dd4292a97c6c2a56906a20b7a910d3519ef875dfc1864333d01a8e223c9f18fa7fedf78dd9cdc5408d
-
SSDEEP
6144:sloZML9EBw/S6NtFnEPfCJxg8JhAA1HM0ryurdEwZThANnp8e1mGRw:qoZhYS6NZLg8JhAA1HM0ryurdEwZTh8C
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1281752709590155376/wFe_vTO1MKOOqSG-vjtrbd6ytwscIOTVT2CLPeLZ1oamVoS_gQzT9qnmapIrBL8dRs9M
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bruteforcer.exe
Files
-
bruteforcer.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 229KB - Virtual size: 228KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ