General
-
Target
black ops 6.rar
-
Size
83KB
-
MD5
8798d9d8f4f6d166ee919e18fb6dd088
-
SHA1
6683954082f40bb8e27797430312ce96b6dcb48e
-
SHA256
a98748afbd3f2a4f86a601eba6edcbce501d27ef25211d6a905ac6af4972816e
-
SHA512
7acd7d019d1a2b46f74c9384985d7a832abb914ca4096b39a09849f875905d76c6a936b440a313176596628979a4f9ecc795edec17c1ffa6e57ec420d0d30e14
-
SSDEEP
1536:pcheGdCNYiGBBV7jEGT5vbikyIlfnau799Bqj57aMG2H:uhdni+j7vbiHq90j5aMGa
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1327867255689842730/_ULB6S7o2Op8KjrN85w5tHjL9oXLj28gNXHfqbVcIDYvguewfw17RyzIYvFFXMKHbKON
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/black ops 6/Call of Duty.exe family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/black ops 6/Call of Duty.exe
Files
-
black ops 6.rar.rar
-
black ops 6/Call of Duty.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ