Overview

overview

10

Static

static

10

Loader.exe

windows7-x64

10

Loader.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Loader.exe

  • Size

    609KB

  • Sample

    240224-rgb6wsdh79

  • MD5

    9893f79d958d0fdf80c2f87fa526696c

  • SHA1

    b5349594b66680de00dd1c64e8ad23f5b60bedec

  • SHA256

    6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87

  • SHA512

    e0eb174f7b0f8e83c9010836bba865cb2320d94c87939f9ec18a1f029bc5eb1baa8691d25c84ed9cf330c4d6f61e627fb2b01393934f38853f44eacea9110e9e

  • SSDEEP

    12288:EoZcL+EP8LhahecjfUn1gevPeVTv6iPVle8w15dQPvY:HI8dahecjfUn1gevPeV7s15uY

Score
10/10
umbralstealer

Malware Config

Targets

    • Target

      Loader.exe

    • Size

      609KB

    • MD5

      9893f79d958d0fdf80c2f87fa526696c

    • SHA1

      b5349594b66680de00dd1c64e8ad23f5b60bedec

    • SHA256

      6c727f906a78ce58fd0970cce1216eaafa833f12ee8f6da2d42839d5ef00fb87

    • SHA512

      e0eb174f7b0f8e83c9010836bba865cb2320d94c87939f9ec18a1f029bc5eb1baa8691d25c84ed9cf330c4d6f61e627fb2b01393934f38853f44eacea9110e9e

    • SSDEEP

      12288:EoZcL+EP8LhahecjfUn1gevPeVTv6iPVle8w15dQPvY:HI8dahecjfUn1gevPeV7s15uY

    Score
    10/10
    umbralstealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks