Behavioral task
behavioral1
Sample
Hypnox TB V1.2.exe
Resource
win7-20241010-en
General
-
Target
Hypnox TB V1.2.exe
-
Size
239KB
-
MD5
f998146f650224b7a945c998246c79ca
-
SHA1
9ab4507aaf84093985febac2d5a28a1f0e00b52e
-
SHA256
93ce8e3689636df1bf9f269f4e96f0e30f3f7c5848778ad12f82275fd4061f85
-
SHA512
50a885cf13d60a59b25c3d9a8110feb5ba67b5f2b028b6abe5efac38b27c2ad5be9dd0f345379763b1b034458cebffd63ee4ce33c5a416b6662f004acf4a8224
-
SSDEEP
6144:rloZMLrIkd8g+EtXHkv/iD4pdeTKInDASZMK7bCQ0b8e1muYZi:poZ0L+EP8pdeTKInDASZMK7bCFjx
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1301023877203492945/qipDBBN580abTipodMZs0CAGX07mE1G1cj1SxxTdczv_B-indLOc15D1v1HAh2NHq6Je
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Hypnox TB V1.2.exe
Files
-
Hypnox TB V1.2.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ