umbral | Krampus[.]rar | Triage

Sharing

General

Target

Krampus.rar
Size

79KB
MD5

75feae218b03a45d1be3f932f353db7b
SHA1

2eef6e858b38c3c5fece824be164debe55e66f2c
SHA256

ed5fe58c45c8b0e48c4c9405ba8065234090e19e145465117e0d2342f43fd872
SHA512

f13949102f6d6117af5f976cd60dc95315b2be20379d2f7bf4606feffa795a69238d1a84f30288d7e1b45fb407dca583bd17cc9cae3bf129feeb4c2526a0a831
SSDEEP

1536:QLU12qQoZKf09z7AgmdFlLLpfOi96k3wu/ad5Z3uxj7TOpYrJtJ4:QmhgqQgmVLx925ZYX/e

Score

10^/10

umbral

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1225264880039235738/46bNxRt60w9YjuGcjqkvDLT2Saa0gXhoe7P2-CbuUHwdxfwONEkNG92CHxRK6S67a3Bd

Signatures

Detect Umbral payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/Krampus/b5uEJHZB6Rl.exe	family_umbral

Umbral family
umbral
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/Krampus/b5uEJHZB6Rl.exe

Files

Krampus.rar
.rar

Password: skibidi
Krampus/b5uEJHZB6Rl.exe
.exe windows:4 windows x86 arch:x86

Password: skibidi

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Krampus/krampusexec-65cafadfc556c.txt