Extracted

• • Target
    download.exe
  • Size 88KB
  • SHA256 40596da4af2b1b0387147484d112423d317e2fd41cd19bb1b63d2f8429bacee4
  • MD5 94c73dc6cc79de28524a82f04adc7c6b
  • SHA1 8ce1411adede8a1485ad718160ef01c7a22634de
  • SHA512 820b38de02b00668b24e6dc0510f632a7648bd1e647f5a9ee0c7d8bd8b86a49b55db72e1cfa2eff0337dc30d6b1cb45af1f904a9105715618d410ff56841d041
  • SSDEEP 768:+CIFqF93IfXwXbOfq1okh8BBEjpaPWfu/WYat7PTXDvt976xrXu5Me0:+C4qF9pbOAh8B+Bfu+YaZTXTt97KruM
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  umbralxwormexecutionratspywarestealertrojanransomware

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4