General
-
Target
SU.exe
-
Size
229KB
-
MD5
05c943e8ae5c31ffe2dfd3eff82aa5c1
-
SHA1
6687440528a26ae933709e79ff486cb5727bb881
-
SHA256
01fb336066beb7d69b8a498acd0c01a0f7a49fb1f3ddfe9e28d2cc628132110c
-
SHA512
79e937aae114229690b11e43ced2a61886b40f57b91e04f24a6b3f6db0f2e2008dac1b44bba274fb75befcbb1bc109b41ac60ac3820c1ff834c68dac3756943b
-
SSDEEP
6144:9loZMNrIkd8g+EtXHkv/iD4N1yBR/k4XxG/BcoNS3b8e1mEXi:foZmL+EP8N1yBR/k4XxG/BcoNkfy
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1318819333895356468/DEfudpHlXMg4k0ZoAl3E4nwXAVdcdawYy71fFBAqS4QpsLYniui-m6zHK2-B_vFeH8mM
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SU.exe
Files
-
SU.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 227KB - Virtual size: 226KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ