Primordial.rar
- SHA256 3a2b81f84a4ed157b1a059be3046930972ee8480be3b67ebf15e9bbc941cf883
Overview
overview
10Static
static
10Primordial...ix.bat
windows10-1703-x64
1Primordial...GL.dll
windows10-1703-x64
3Primordial...v2.dll
windows10-1703-x64
3Primordial...et.dll
windows10-1703-x64
3Primordial...nt.dll
windows10-1703-x64
3Primordial..._1.dll
windows10-1703-x64
3Primordial...32.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
1Primordial..._1.dll
windows10-1703-x64
3Primordial...-6.dll
windows10-1703-x64
3Primordial...-1.dll
windows10-1703-x64
3Primordial...sw.dll
windows10-1703-x64
3Primordial...in.dll
windows10-1703-x64
3Primordial...ix.dll
windows10-1703-x64
1Primordial...al.exe
windows10-1703-x64
10Primordial...or.dll
windows10-1703-x64
1Behavioral task
behavioral1
Sample
Primordial/FIX/fix.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Primordial/FIX/libEGL.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Primordial/FIX/libGLESv2.dll
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
Primordial/FIX/libQt-Secret.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Primordial/FIX/libQtBigint.dll
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Primordial/FIX/libcrypto-1_1.dll
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Primordial/FIX/libeay32.dll
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Primordial/FIX/libgcc_s_dw2-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Primordial/FIX/libgcc_s_seh-1.dll
Resource
win10-20240611-en
Behavioral task
behavioral10
Sample
Primordial/FIX/libssl-1_1.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Primordial/FIX/libstdc++-6.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Primordial/FIX/libwinpthread-1.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Primordial/FIX/opengl32sw.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Primordial/FIX/qtquick2plugin.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Primordial/FIX/steamfix.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Primordial/Primordial.exe
Resource
win10-20240611-en
Behavioral task
behavioral17
Sample
Primordial/injector.dll
Resource
win10-20240404-en
umbral
https://discord.com/api/webhooks/1270399724431867935/HjClfkOVqhZa8ElKgkYuPRyoXVGf7yB2AqieOsUFaDEyif-Oe__Dw5TFjFKt_Mc4n-Dr
| resource | yara_rule |
|---|---|
| static1/unpack001/Primordial/Primordial.exe | family_umbral |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Primordial/FIX/libQt-Secret.dll |
| unpack001/Primordial/FIX/libQtBigint.dll |
| unpack001/Primordial/FIX/libgcc_s_dw2-1.dll |
| unpack001/Primordial/FIX/libgcc_s_seh-1.dll |
| unpack001/Primordial/FIX/libstdc++-6.dll |
| unpack001/Primordial/FIX/libwinpthread-1.dll |
| unpack001/Primordial/FIX/opengl32sw.dll |
| unpack001/Primordial/Primordial.exe |
Sep 3, 2020
Sep 3, 2020
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 28, 2020
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
May 19, 2017
CN=OpenVPN Technologies\, Inc.,O=OpenVPN Technologies\, Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 28, 2020
CN=OpenVPN Inc.,O=OpenVPN Inc.,L=Pleasanton,ST=California,C=US
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=49, id=241, version=40116,
count=166, id=243, version=40116,
count=59, id=242, version=40116,
count=6, id=199, version=41118,
count=40, id=259, version=23907,
count=54, id=261, version=23907,
count=32, id=260, version=23907,
count=13, id=239, version=40116,
count=182, id=1, productName=Unmarked objects,
count=6, id=260, productName=VS2015 UPD2 build 23918, version=23918,
count=492, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=577, id=264, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
Nov 6, 2020
Detect Umbral payload
Unsigned PE
Checks for missing Authenticode signature.