umbral

General

Target

Result.exe
Size

726KB
Sample

240625-d7nqqasamr
MD5

0245f169326caac63addc173108df7c2
SHA1

abc37ad9cb71c52be4b942c54572c79db7b4a0c8
SHA256

d8d40b07a4324fc82badf80651e9b6ab367df60907ecc5f98bada0b81269924b
SHA512

1eff4ff2eee9f9aca8b488f72183592a01d0b94967b2a8a88c12788a7f277c1cbdde0cbfb40a21f94b734b161bbba3877898e7d9dd1c39b37e7e6116b43de46e
SSDEEP

12288:yoZtL+EP8YwjLxfEY3zmfh8ItEGQR/y00bzAlvpYq1orkEHck8IzDqY33k0ero5i:2I8ljLxfEY3zmfh8ItEHfMgsvqY3Crog

Score

10^/10

Malware Config

Targets

- Target
  
  Result.exe
- Size
  
  726KB
- MD5
  
  0245f169326caac63addc173108df7c2
- SHA1
  
  abc37ad9cb71c52be4b942c54572c79db7b4a0c8
- SHA256
  
  d8d40b07a4324fc82badf80651e9b6ab367df60907ecc5f98bada0b81269924b
- SHA512
  
  1eff4ff2eee9f9aca8b488f72183592a01d0b94967b2a8a88c12788a7f277c1cbdde0cbfb40a21f94b734b161bbba3877898e7d9dd1c39b37e7e6116b43de46e
- SSDEEP
  
  12288:yoZtL+EP8YwjLxfEY3zmfh8ItEGQR/y00bzAlvpYq1orkEHck8IzDqY33k0ero5i:2I8ljLxfEY3zmfh8ItEHfMgsvqY3Crog
Score

10^/10

umbral evasion execution persistence spyware stealer trojan upx
- Detect Umbral payload
- UAC bypass
  evasion trojan
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1