umbral

General

Target

Client.exe
Size

328KB
Sample

240615-rxx4asxgmj
MD5

0518135d19cbb497321df931809a30e8
SHA1

34981352c51a3e3b9031902cc3f733d252c12871
SHA256

88cf131986bedc03a33d12ea5392ce09f521d40a056b8576a34ee613f36479e5
SHA512

adfe6c11cf1af4a5b7af799c2e0d89a660f695149407b54449a3ff4b8186dd3fca3f508670aede4b0592942294ca96d156f2f681a2aaf11481c0711670a17fa2
SSDEEP

6144:P5QCJJfSBEmcHe6VlWT8b9uPUfMP0ftbi8J5HW5T:BQNEvHPVle8eaB/HW

Score

10^/10

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1250802209801768990/UT-yM703TnMgIG2q_IWqIrXHEZ99hyOELHLD6lrsVAgD9l11Of5HuA0IV9npCGc-mIfm

Targets

- Target
  
  Client.exe
- Size
  
  328KB
- MD5
  
  0518135d19cbb497321df931809a30e8
- SHA1
  
  34981352c51a3e3b9031902cc3f733d252c12871
- SHA256
  
  88cf131986bedc03a33d12ea5392ce09f521d40a056b8576a34ee613f36479e5
- SHA512
  
  adfe6c11cf1af4a5b7af799c2e0d89a660f695149407b54449a3ff4b8186dd3fca3f508670aede4b0592942294ca96d156f2f681a2aaf11481c0711670a17fa2
- SSDEEP
  
  6144:P5QCJJfSBEmcHe6VlWT8b9uPUfMP0ftbi8J5HW5T:BQNEvHPVle8eaB/HW
Score

10^/10

umbral evasion execution persistence spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- UAC bypass
  evasion trojan
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Modifies AppInit DLL entries
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2