General

  • Target

    Xeno.exe

  • Size

    227KB

  • MD5

    6b880150debb9697c8bc4ef9c88d2767

  • SHA1

    157f06eb7ff46e3586f186b265d14a816f3fd2d1

  • SHA256

    21fd303a6f0cdccb2d6e349317b6e464ccb514f9cd5a2ee3c1d191c801ff0b46

  • SHA512

    93acc76719154217a0b04d19964a2c5fded5b4e12eb052fef28654e2d1b01f24e4284c9851c8038cbeb3e939128a3913c8954b015fce67ff89772d26ddf014ce

  • SSDEEP

    6144:+loZM9rIkd8g+EtXHkv/iD4+ZZjjpaC9bop7mGzsmXb8e1mbri:ooZOL+EP8+ZZjjpaC9bop7mGzbJ

Score
10/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1342920471783542836/OunFkHC0-8AiK-lZk7zc5-fESw0GXU2reuQ4CmW1TFKgzgl278EgDA8pAWf5KUaOGK7g

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • Xeno.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections