Behavioral task
behavioral1
Sample
freerobux.exe
Resource
win7-20240708-en
General
-
Target
freerobux.exe
-
Size
229KB
-
MD5
b994081ca7787fdf253902e28c1a5c47
-
SHA1
91c30f314dda937fac7b5133c4f378e6c2cd47ff
-
SHA256
429170a034f165b7b9223205b04482ba8b1cc5582f9344bf70123c7e7e8e4c3e
-
SHA512
17b80c2325c0e900fa1a2c026d8eba0c3985ce27bb71c4f226a6d52a3f0122e4ad969fb163d75ec435169ea12c8b9538777986ab2dc498e5529d94ce20d019d4
-
SSDEEP
6144:FloZMArIkd8g+EtXHkv/iD4vWEs9rI8jP67NokR37b8e1mAi:HoZHL+EP8vWEs9rI8jP67NokRv+
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1288224776254394470/iP_c6Ebotsq_Xeu-hSVUeaYBh05AwT2JFnXZ2GC6swyPaRqktRcnaOFbF_r6DJCA2gOd
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource freerobux.exe
Files
-
freerobux.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ