General
-
Target
FIXER-2.3.exe
-
Size
678KB
-
Sample
240605-trytracf29
-
MD5
c4a81b5b47dab29d88805f75c95035a0
-
SHA1
092fcb36a736198e19530c96991d9bcb0354fa75
-
SHA256
1ce288b4eace5690b66c6681e77f4f75d1c5fda07eab5a410ffe38271d515909
-
SHA512
eb98f91df470f6f52ad8db2d44da3a090b63d4067e371ca8df1b5e54e7623123d6ba7df779b27cf6298d7778b415e9569f29c62ef6276f8d666134ff4aa7006e
-
SSDEEP
6144:u4zMHU2N3RSUDqnopqonzuv4NIAyxuQiOfFs3OJ18xNz+KgbqUypit:u44RuS78onzuv4NIAAuQkOzu
Static task
static1
Behavioral task
behavioral1
Sample
FIXER-2.3.exe
Resource
win10-20240404-en
Malware Config
Extracted
umbral
https://discordapp.com/api/webhooks/1247657758921330688/6inL47rtBda5FWXQ9j3KkuojoQUQIHytZMOftRLQPHv1vmGRuP44zUd_P2lo-8gb3cBC
Targets
-
-
Target
FIXER-2.3.exe
-
Size
678KB
-
MD5
c4a81b5b47dab29d88805f75c95035a0
-
SHA1
092fcb36a736198e19530c96991d9bcb0354fa75
-
SHA256
1ce288b4eace5690b66c6681e77f4f75d1c5fda07eab5a410ffe38271d515909
-
SHA512
eb98f91df470f6f52ad8db2d44da3a090b63d4067e371ca8df1b5e54e7623123d6ba7df779b27cf6298d7778b415e9569f29c62ef6276f8d666134ff4aa7006e
-
SSDEEP
6144:u4zMHU2N3RSUDqnopqonzuv4NIAyxuQiOfFs3OJ18xNz+KgbqUypit:u44RuS78onzuv4NIAAuQkOzu
-
Detect Umbral payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-