General

  • Target

    Primordial.rar

  • Size

    8.3MB

  • MD5

    4b72de5e5992c017f84249687adf30cd

  • SHA1

    119b83b4c112e3d47ac203e93b9340cdb7bd584a

  • SHA256

    3a2b81f84a4ed157b1a059be3046930972ee8480be3b67ebf15e9bbc941cf883

  • SHA512

    5aab0a9a77818f773eae775433dbaf95deb289364f2693ea5f95ec261fcf2c28f08b264a778c84c5ec2b3539e176a34837e214bd4fab570785a6b7c783e225d3

  • SSDEEP

    196608:4YumurC26vuvF84Q1U7dR9D0CY73LVkaG9vXsnuji1D:4Yumu184TdRnY73nUnji1D

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1270399724431867935/HjClfkOVqhZa8ElKgkYuPRyoXVGf7yB2AqieOsUFaDEyif-Oe__Dw5TFjFKt_Mc4n-Dr

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • Primordial.rar
    .rar

    Password: 2024

  • Primordial/FIX/README.txt
  • Primordial/FIX/fix.bat
  • Primordial/FIX/libEGL.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    c528ebb689f5d5acecf9ec15a0e398b9


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libGLESv2.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    08cc0e06e3718f172067ab05bf14d227


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libQt-Secret.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    178f242190d56aa821e1438ebbf180fc


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libQtBigint.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    47518a6ad73ca12f2a45aa2f57ee72aa


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libcrypto-1_1.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    a543d3b1f1e76db5f1ab4d97a41e7c66


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libeay32.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    32d53878cd567e62bc29491eaf366d6e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libgcc_s_dw2-1.dll
    .dll windows:4 windows x86 arch:x86

    Password: 2024

    04f9a5136edc374e78bc81dc8b0d07af


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libgcc_s_seh-1.dll
    .dll windows:4 windows x64 arch:x64

    Password: 2024

    b8547353b6beb87cf7560462f9aacd11


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libssl-1_1.dll
    .dll windows:4 windows x86 arch:x86

    6663011618da49103de7d8dbcb3a0028


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libstdc++-6.dll
    .dll windows:4 windows x86 arch:x86

    7005a39fe3ac4a4de5ba76c62ac8c550


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/libwinpthread-1.dll
    .dll windows:4 windows x86 arch:x86

    d864b24802c8704c7789fda27be17205


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/opengl32sw.dll
    .dll windows:6 windows x86 arch:x86

    96787902f59fced940d332fc8148bd5c


    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/qtquick2plugin.dll
    .dll windows:4 windows x86 arch:x86

    f40980713af8bc46828f3f826b9a0d46


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Primordial/FIX/steamfix.dll
  • Primordial/Primordial.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Primordial/Primordialwin.pdb
  • Primordial/cfg/legit.cfg
  • Primordial/cfg/rage.cfg
  • Primordial/crack.pdb
  • Primordial/injector.dll