General

  • Target

    TEST.rar

  • Size

    80KB

  • Sample

    240607-x412esdc96

  • MD5

    b73a235392b360b22f6b244b0b0af97a

  • SHA1

    524829a16a97ba862337b8ad7ec86707e231cfe9

  • SHA256

    c2caa0fa4a868c131c9139635dd57f67ec1bba9283ab4b0a121fdff5a4a21082

  • SHA512

    50122d08a5965c537ab7bf9bc8c5372ae48858459e47a652e04d98a3dc8c02f5664f759600e07b658de543696c0c06dbf0311d583168ae43427f67c057801c64

  • SSDEEP

    1536:5PJo3xi6Dpg60TuRW3mF50HuCvsfqSYh35wHGIDO8sGAYNQ7OPqyMHC96:5C3s6DpF0Kg3mFWdcqhwHGUO0qIn96

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1248680916088524882/scOLRb8Ed3pZrVLq-wxEU3RMvJbAjEVyHOhqKEPHD6NL1h3WeGeXo53UPUp5psuRr4DL

Targets

    • Target

      TEST.exe

    • Size

      229KB

    • MD5

      9dc985d83754309760ae45747d8081c2

    • SHA1

      b60e1c39ee8da20c5bdf1df501fab12fd45eaf50

    • SHA256

      f3fdf0137c30af49a71a174e204795a0b96ef2a8a0a53fda4add34574f79005b

    • SHA512

      d0908c5e493bd83cd58e73b715c9318cb6032bb388d7c6ffbdc75b4bb813e594153a57e2ecebbe0a2d1aa0513312be16886b08ad8b91fc590217838057a730cf

    • SSDEEP

      6144:tloZM+rIkd8g+EtXHkv/iD4hYBSGELnsmd42X3WVzb8e1mzi:voZtL+EP8hYBSGELnsmd42X3WtB

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks