Overview

overview

10

Static

static

10

UNBANNED-G...er.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    UNBANNED-GG-PERM-10-18-23.rar
  • Size 180KB
  • Sample240602-cbjlfsfe44
  • SHA256 5e9b07ad114b05286b58dc0e888e3aa102d207a1beac3d90a32518d837b2887f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
umbralevasionpersistencestealer

Malware Config

Extracted

Family

  • umbral

C2

  • https://discordapp.com/api/webhooks/1246463015998586960/d4v_qESsKe8s7VticwxHvyytkOUO321t7x3oNxoyCNYQuwczEVfPUDFWHLnPpAM4tNJ_

Targets

    • Target
      UNBANNED-GG-PERM-10-18-23/loader.exe
    • Size 365KB
    • SHA256 20be105c4a33ebf77ef4db7e8b6ebbb39b156fe1dd16473a7255903f33b76846
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    umbralevasionpersistencestealer

    • Detect Umbral payload

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks