umbral | Bat To 0Exe[.]exe

General

Target
Bat To 0Exe.exe
Size 1005KB
Sample261113-nn71csty9n
SHA256 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191
MD5 6bf2d368d054aef36f8e083ce54c31de
SHA1 f417b5dcc2354408f20f71522d1d9ed9fa9ff1cd
SHA512 4c404a5369d35dbbb00ed58f0389f63e664b58295f0a12ca8e8bfbf29d53ef0612777ab9cb7acf5d7b74fc04d7655eae5763455d99a4b817d764c6858a28d56e
SSDEEP 12288:1oZZL+EP8pOpvcCFdWwj+ctBI4K4/ZrvIGS:HI8YpvcCFdWwj+ctBI4/Z9S
TLSH
T1E825184323688E12D52E47FD8172D9BE4773AE66A825E34E0CD8BCF73A337425805A53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer umbral

Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
stealer umbral

Detects Umbral payload 1 IoCs

resource	yara_rule
sample	family_umbral

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Bat To 0Exe.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 94509784f4e6bbe7ddcb00d09f2325cf9baec1cc80e14b5114987798aca3f191
MD5 6bf2d368d054aef36f8e083ce54c31de
SHA1 f417b5dcc2354408f20f71522d1d9ed9fa9ff1cd
SHA512 4c404a5369d35dbbb00ed58f0389f63e664b58295f0a12ca8e8bfbf29d53ef0612777ab9cb7acf5d7b74fc04d7655eae5763455d99a4b817d764c6858a28d56e
SSDEEP 12288:1oZZL+EP8pOpvcCFdWwj+ctBI4K4/ZrvIGS:HI8YpvcCFdWwj+ctBI4/Z9S
TLSH
T1E825184323688E12D52E47FD8172D9BE4773AE66A825E34E0CD8BCF73A337425805A53
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

22926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Documents and Settings\1134\My Documents\Visual Studio 2008\Projects\72389 binder stub\72389 binder stub\obj\Debug\72389 binder stub.pdb