Overview

overview

10

Static

static

10

Bunifu.Licensing.dll

windows7-x64

1

Bunifu.Licensing.dll

windows10-2004-x64

1

CODEMCFA.exe

windows7-x64

10

CODEMCFA.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MCFACODEGEN.rar

  • Size

    1.2MB

  • MD5

    69e5611ea942cd21a757560655ccacf2

  • SHA1

    0d2ad44df6dff58c89a6a9c3e6373c99e3b81bfa

  • SHA256

    6f806a1b18c89c3a482ccfb2b525eae695e9ad7c533b4c503aa1c7f3c29fc71b

  • SHA512

    51df06538b27c790fe900feff39a226238bec681311eed9ad1e40067010e2496da174f4b8bb91b89ecc96fd614977d94eb3971e9a8d422d19367d8df35168be3

  • SSDEEP

    24576:NJYoATtIVUnKlWRgMe4xsebNjWjYckZUb1bD+G5A3vIcHP6qAG2eGs1Gb:PA5SUnmThzebNJZUbhKG5iAcv6qAGBy

Score
10/10
agilenetumbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1298608602063437835/JyCfJN4kOZTYSMy3p7C0nzjwBZVeXN-s99bZmxGmhCwtA9ugQjsNEeKH7DXCeDl2AAko

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
    umbral
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • MCFACODEGEN.rar
    .rar

    Password: skibidiutrynaratme

  • Bunifu.Licensing.dll
    .dll windows:4 windows x86 arch:x86

    Password: skibidiutrynaratme

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CODEMCFA.exe
    .exe windows:4 windows x86 arch:x86

    Password: skibidiutrynaratme

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections