General
-
Target
token_bot.rar
-
Size
80KB
-
Sample
240607-wldyhabf4z
-
MD5
91e5c9a236940fd4c7af78bcea389148
-
SHA1
80f5c22f41b29628636e0312641c973c1768aa90
-
SHA256
65080b04dd095e82f027e05f0df8afd367f0b167d7400bf4e2e1626464166a02
-
SHA512
287265a7e60da70f4a4667d74923fa3676b97a07b884802cdcde009f9ad5eac911b424eaa9b4969b93f1dbe001ec9713b325b548be174d71ea27d32be03169f1
-
SSDEEP
1536:X+mdm478eiTC0OnB52R/HPl1s4MDkzQpSQdaxa3PtmQ+y1:X+yYjsnD2RvPQUipf45y1
Behavioral task
behavioral1
Sample
token bot.exe
Resource
win7-20240221-en
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1248680916088524882/scOLRb8Ed3pZrVLq-wxEU3RMvJbAjEVyHOhqKEPHD6NL1h3WeGeXo53UPUp5psuRr4DL
Targets
-
-
Target
token bot.exe
-
Size
229KB
-
MD5
9dc985d83754309760ae45747d8081c2
-
SHA1
b60e1c39ee8da20c5bdf1df501fab12fd45eaf50
-
SHA256
f3fdf0137c30af49a71a174e204795a0b96ef2a8a0a53fda4add34574f79005b
-
SHA512
d0908c5e493bd83cd58e73b715c9318cb6032bb388d7c6ffbdc75b4bb813e594153a57e2ecebbe0a2d1aa0513312be16886b08ad8b91fc590217838057a730cf
-
SSDEEP
6144:tloZM+rIkd8g+EtXHkv/iD4hYBSGELnsmd42X3WVzb8e1mzi:voZtL+EP8hYBSGELnsmd42X3WtB
-
Detect Umbral payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-