General
- Target Blox hackl.rar
- Size 77KB
- Sample260914-p9xbesywgy
- SHA256 5e8d0dd5f0a1b43f9853b328cd84420bf2e30583326f1ead3f7e20682c847477
- MD5 29750d3e6c0a7c7638de2c4bd068604b
- SHA1 0365992161bce3d88ff286ed4a1870f843188581
- SHA512 5cbf808099e8093727b82c74867b45dd851ffafa22e79917abcdbc3f58193f59fcb05d6936c39fd1c33774df16cdf888279d048872eb911ab297eb4b2e46e37b
- SSDEEP 1536:0K1/oXQfGmUzfzXNGflS24sYQ4fvFh8PJWhnvSR3C8t9+JoYlB+QwWaalk:0K5oXNJx/s4tUJWhnKR3C8toXBRQaK
- TLSH T1347302E0509E15A871B4ABDB0DECF222B69C5D672ABF26149ED86C477D0B0B870970B0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Malware Config
Extracted
Family
-
umbral
Version
-
v1.3
C2
-
https://discord.com/api/webhooks/1548734521741025330/wZ_JtGM9D2P-Gt6D1Wd2XSwYJoMJJ6hxl6ro9quiJycYYvM3Q_eQv_ZDBj0TYBEanUry
Targets
-
- Target Blox hackl.rar
- Size 77KB
- SHA256 5e8d0dd5f0a1b43f9853b328cd84420bf2e30583326f1ead3f7e20682c847477
- MD5 29750d3e6c0a7c7638de2c4bd068604b
- SHA1 0365992161bce3d88ff286ed4a1870f843188581
- SHA512 5cbf808099e8093727b82c74867b45dd851ffafa22e79917abcdbc3f58193f59fcb05d6936c39fd1c33774df16cdf888279d048872eb911ab297eb4b2e46e37b
- SSDEEP 1536:0K1/oXQfGmUzfzXNGflS24sYQ4fvFh8PJWhnvSR3C8t9+JoYlB+QwWaalk:0K5oXNJx/s4tUJWhnKR3C8toXBRQaK
- TLSH T1347302E0509E15A871B4ABDB0DECF222B69C5D672ABF26149ED86C477D0B0B870970B0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Umbral payload
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.