General

  • Target

    release5102024.exe

  • Size

    234KB

  • Sample

    240526-v36jeaeh69

  • MD5

    0e686473973693d296760e2c8ea19dd8

  • SHA1

    80bf5c75bebb592eb88322c3a4dda1f056b33b69

  • SHA256

    330257ac72a4b7cb8d45cbb4d5f888bc6c69f139e7b0edf1cb64f2c733d846f7

  • SHA512

    c06039e42a95c8ca0ec7fc8bfa5ac002208ffe69d49f7379ab272772496a1c08e165b7220748df52233ef7187c2204ecf2eecaa9a7aceeabd3b29bc32fe84e0f

  • SSDEEP

    6144:XloZM+rIkd8g+EtXHkv/iD43WZwEbhS6FvAxDeebyAb8e1m9ii4:1oZtL+EP83WZwEbhS6FvAxDeeb7m

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1238594444178096289/TfFp2BIF3gI-jN7QcJ_G3TBbemRzhLns-wcLMlz-XMR6wfrO6onaNYV-JZ-f4ISI78_y

Targets

    • Target

      release5102024.exe

    • Size

      234KB

    • MD5

      0e686473973693d296760e2c8ea19dd8

    • SHA1

      80bf5c75bebb592eb88322c3a4dda1f056b33b69

    • SHA256

      330257ac72a4b7cb8d45cbb4d5f888bc6c69f139e7b0edf1cb64f2c733d846f7

    • SHA512

      c06039e42a95c8ca0ec7fc8bfa5ac002208ffe69d49f7379ab272772496a1c08e165b7220748df52233ef7187c2204ecf2eecaa9a7aceeabd3b29bc32fe84e0f

    • SSDEEP

      6144:XloZM+rIkd8g+EtXHkv/iD43WZwEbhS6FvAxDeebyAb8e1m9ii4:1oZtL+EP83WZwEbhS6FvAxDeeb7m

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks