Overview

overview

10

Static

static

1

Lavalink (2).jar

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Lavalink (2).jar

  • Size

    64.0MB

  • Sample

    231208-1sqcbseeg9

  • MD5

    f141ae90086969958a7ee8fa3b11db33

  • SHA1

    d184f9b6543d6d275edd321c9c65cc11419d6139

  • SHA256

    8cec95cadb52efaf46fbd4342a8dba4b3dc6e99d12ed72898071fc2482419520

  • SHA512

    1c8205ed17972cbd7dc440c86bf39ac8fc7e16b6f701a736f0f02ff995b40b69d1eef0ae608192e8363ae5ed3e44b3b01d1db2b6b421400482bcff182e60cdb0

  • SSDEEP

    1572864:d2itUw+2zdMDnqHP0CKHBYMlXEX4/4gRtQB4:vtUw+2R38CKHBYgo4/a4

Score
10/10
umbralxwormdiscoveryratstealertrojan

Malware Config

Extracted

Family

xworm

C2

owner-cc.gl.at.ply.gg:32281

Attributes
  • Install_directory

    %AppData%

  • install_file

    WindowsSoundSystem.exe

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1182794899272249374/0RAK-d1IIp_G9JphscLf5z-kuIMWAVGEU8Wy78vDGicqvlTsUJ6RjUqg5bgReS8M_pDx

Targets

    • Target

      Lavalink (2).jar

    • Size

      64.0MB

    • MD5

      f141ae90086969958a7ee8fa3b11db33

    • SHA1

      d184f9b6543d6d275edd321c9c65cc11419d6139

    • SHA256

      8cec95cadb52efaf46fbd4342a8dba4b3dc6e99d12ed72898071fc2482419520

    • SHA512

      1c8205ed17972cbd7dc440c86bf39ac8fc7e16b6f701a736f0f02ff995b40b69d1eef0ae608192e8363ae5ed3e44b3b01d1db2b6b421400482bcff182e60cdb0

    • SSDEEP

      1572864:d2itUw+2zdMDnqHP0CKHBYMlXEX4/4gRtQB4:vtUw+2R38CKHBYgo4/a4

    Score
    10/10
    umbralxwormdiscoveryratstealertrojan

    • Detect Umbral payload

    • Detect Xworm Payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Drops startup file

    • Executes dropped EXE

    • Modifies file permissions

      discovery
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks