General
- Target immortal.bin.exe
- Size 1.1MB
- Sample240427-15m3qshf69
- SHA256 ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
Score
10/10
Malware Config
Targets
-
- Target immortal.bin.exe
- Size 1.1MB
- SHA256 ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
Score10/10Detect Umbral payload
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger