General
-
Target
release5102024.exe
-
Size
234KB
-
Sample
240526-v36jeaeh69
-
MD5
0e686473973693d296760e2c8ea19dd8
-
SHA1
80bf5c75bebb592eb88322c3a4dda1f056b33b69
-
SHA256
330257ac72a4b7cb8d45cbb4d5f888bc6c69f139e7b0edf1cb64f2c733d846f7
-
SHA512
c06039e42a95c8ca0ec7fc8bfa5ac002208ffe69d49f7379ab272772496a1c08e165b7220748df52233ef7187c2204ecf2eecaa9a7aceeabd3b29bc32fe84e0f
-
SSDEEP
6144:XloZM+rIkd8g+EtXHkv/iD43WZwEbhS6FvAxDeebyAb8e1m9ii4:1oZtL+EP83WZwEbhS6FvAxDeeb7m
Behavioral task
behavioral1
Sample
release5102024.exe
Resource
win7-20240419-en
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1238594444178096289/TfFp2BIF3gI-jN7QcJ_G3TBbemRzhLns-wcLMlz-XMR6wfrO6onaNYV-JZ-f4ISI78_y
Targets
-
-
Target
release5102024.exe
-
Size
234KB
-
MD5
0e686473973693d296760e2c8ea19dd8
-
SHA1
80bf5c75bebb592eb88322c3a4dda1f056b33b69
-
SHA256
330257ac72a4b7cb8d45cbb4d5f888bc6c69f139e7b0edf1cb64f2c733d846f7
-
SHA512
c06039e42a95c8ca0ec7fc8bfa5ac002208ffe69d49f7379ab272772496a1c08e165b7220748df52233ef7187c2204ecf2eecaa9a7aceeabd3b29bc32fe84e0f
-
SSDEEP
6144:XloZM+rIkd8g+EtXHkv/iD43WZwEbhS6FvAxDeebyAb8e1m9ii4:1oZtL+EP83WZwEbhS6FvAxDeeb7m
-
Detect Umbral payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Deletes itself
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-