Extracted

• • Target

    ElectricLauncher.7z

  • Size

    51.5MB

  • MD5

    cdb5e0ea8a50e1ed5e80f2fc70883550

  • SHA1

    b5075928e63a609ca7b61748a989de77fc092439

  • SHA256

    01342213b45659a27b48f65b73b7043b84faba91ca8f80963560d824097e5ed1

  • SHA512

    73fc72b19754f72ca6122c132851e2a7f95573d7f11a78ac01020a1fdd84e9fe54425de044814f517618224e6c9045ea1316b67f55976f19ae276fbc76e4e8b8

  • SSDEEP

    786432:D1hq7lbHq0joZGThd/SLAqWBHK4A5ffZfewdfONYYGfXF6uIfrNaEU8ruVGwQeB+:DW9Hq0jy8hp9qW41ZWq3XF6S8rKB+

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-convert-l1-1-0.dll

  • Size

    15KB

  • MD5

    4ec4790281017e616af632da1dc624e1

  • SHA1

    342b15c5d3e34ab4ac0b9904b95d0d5b074447b7

  • SHA256

    5cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639

  • SHA512

    80c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69

  • SSDEEP

    192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm

  Score

  1^/10
  behavioral3

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-environment-l1-1-0.dll

  • Size

    11KB

  • MD5

    7a859e91fdcf78a584ac93aa85371bc9

  • SHA1

    1fa9d9cad7cc26808e697373c1f5f32aaf59d6b7

  • SHA256

    b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607

  • SHA512

    a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887

  • SSDEEP

    192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv

  Score

  1^/10
  behavioral4

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-filesystem-l1-1-0.dll

  • Size

    13KB

  • MD5

    972544ade7e32bfdeb28b39bc734cdee

  • SHA1

    87816f4afabbdec0ec2cfeb417748398505c5aa9

  • SHA256

    7102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86

  • SHA512

    5e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1

  • SSDEEP

    192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY

  Score

  1^/10
  behavioral5

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-heap-l1-1-0.dll

  • Size

    12KB

  • MD5

    8906279245f7385b189a6b0b67df2d7c

  • SHA1

    fcf03d9043a2daafe8e28dee0b130513677227e4

  • SHA256

    f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f

  • SHA512

    67cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9

  • SSDEEP

    192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI

  Score

  1^/10
  behavioral6

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-locale-l1-1-0.dll

  • Size

    11KB

  • MD5

    dd8176e132eedea3322443046ac35ca2

  • SHA1

    d13587c7cc52b2c6fbcaa548c8ed2c771a260769

  • SHA256

    2eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e

  • SHA512

    77cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253

  • SSDEEP

    192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1

  Score

  1^/10
  behavioral7

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-math-l1-1-0.dll

  • Size

    20KB

  • MD5

    a6a3d6d11d623e16866f38185853facd

  • SHA1

    fbeadd1e9016908ecce5753de1d435d6fcf3d0b5

  • SHA256

    a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0

  • SHA512

    abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c

  • SSDEEP

    384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc

  Score

  1^/10
  behavioral8

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-multibyte-l1-1-0.dll

  • Size

    19KB

  • MD5

    b5c8af5badcdefd8812af4f63364fe2b

  • SHA1

    750678935010a83e2d83769445f0d249e4568a8d

  • SHA256

    7101b3dff525ea47b7a40dd96544c944ae400447df7a6acd07363b6d7968b889

  • SHA512

    a2a8d08d658f5ed368f9fb556bfb13b897f31e9540bfdfff6567826614d6c5f0d64bd08fec66c63e74d852ab6b083294e187507e83f2bc284dfb7ca5c86ae047

  • SSDEEP

    384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3

  Score

  1^/10
  behavioral9

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-private-l1-1-0.dll

  • Size

    62KB

  • MD5

    d76e7aaecb3d1ca9948c31bdae52eb9d

  • SHA1

    142a2bb0084faa2a25d0028846921545f09d9ae9

  • SHA256

    785c49fd9f99c6eb636d78887aa186233e9304921dd835dee8f72e2609ff65c4

  • SHA512

    52da403286659cf201c72fa0ab3c506ade86c7e2fef679f35876a5cec4aee97afbc5bb13a259c51efb8706f6ae7f5a6a3800176b89f424b6a4e9f3d5b8289620

  • SSDEEP

    1536:2PMeDe5c4bFe2JyhcvxXWpD7d3334BkZn+Ppzh:2DDe5c4bFe2JyhcvxXWpD7d3334BkZnU

  Score

  1^/10
  behavioral10

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-process-l1-1-0.dll

  • Size

    12KB

  • MD5

    074b81a625fb68159431bb556d28fab5

  • SHA1

    20f8ead66d548cfa861bc366bb1250ced165be24

  • SHA256

    3af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65

  • SHA512

    36388c3effa0d94cf626decaa1da427801cc5607a2106abdadf92252c6f6fd2ce5bf0802f5d0a4245a1ffdb4481464c99d60510cf95e83ebaf17bd3d6acbc3dc

  • SSDEEP

    192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1

  Score

  1^/10
  behavioral11

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-runtime-l1-1-0.dll

  • Size

    15KB

  • MD5

    f1a23c251fcbb7041496352ec9bcffbe

  • SHA1

    be4a00642ec82465bc7b3d0cc07d4e8df72094e8

  • SHA256

    d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198

  • SHA512

    31f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9

  • SSDEEP

    192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK

  Score

  1^/10
  behavioral12

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-stdio-l1-1-0.dll

  • Size

    17KB

  • MD5

    55b2eb7f17f82b2096e94bca9d2db901

  • SHA1

    44d85f1b1134ee7a609165e9c142188c0f0b17e0

  • SHA256

    f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb

  • SHA512

    0cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5

  • SSDEEP

    192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO

  Score

  1^/10
  behavioral13

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-string-l1-1-0.dll

  • Size

    17KB

  • MD5

    9b79965f06fd756a5efde11e8d373108

  • SHA1

    3b9de8bf6b912f19f7742ad34a875cbe2b5ffa50

  • SHA256

    1a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6

  • SHA512

    7d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb

  • SSDEEP

    384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft

  Score

  1^/10
  behavioral14

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-time-l1-1-0.dll

  • Size

    13KB

  • MD5

    1d48a3189a55b632798f0e859628b0fb

  • SHA1

    61569a8e4f37adc353986d83efc90dc043cdc673

  • SHA256

    b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0

  • SHA512

    47f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f

  • SSDEEP

    192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V

  Score

  1^/10
  behavioral15

• • Target

    ElectricLauncher/jre/bin/api-ms-win-crt-utility-l1-1-0.dll

  • Size

    11KB

  • MD5

    dbc27d384679916ba76316fb5e972ea6

  • SHA1

    fb9f021f2220c852f6ff4ea94e8577368f0616a4

  • SHA256

    dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1

  • SHA512

    cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e

  • SSDEEP

    192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c

  Score

  1^/10
  behavioral16

• • Target

    ElectricLauncher/jre/bin/awt.dll

  • Size

    1.3MB

  • MD5

    39a3de251306cbca47cf2fb10089ae9f

  • SHA1

    cc3f3d1bc3ad172c9646961b18fe1d7bf98b59a5

  • SHA256

    6d1c82cad959b7e4636d8fced4368f0f2c8da4ef609667396e8772ad8d63f736

  • SHA512

    351a02453659d04a2943abc1da2b9541f97982ed3f94d288679dfd8d962bfb4b0dcdef9b06d329bdad64e032b0372733ff7d1577c49952accf86b971aed86f7e

  • SSDEEP

    24576:or19iF8DpwAZGFCFcbtv5nHSaELVPwtDi6MDO6aBN1VWgerlE6:6XiF8tpGFJHwVoY6MDO6aBN1cLf

  Score

  1^/10
  behavioral17behavioral18

• • Target

    ElectricLauncher/jre/bin/bci.dll

  • Size

    24KB

  • MD5

    a006952024c28abe7ec347e83de47430

  • SHA1

    5bae86cdf7cc277f5ca151539b063d031d377815

  • SHA256

    7da0abac575380695f6fc4ac9847c62ee8fc0c3b63d590b4ce3b408234a2f8a3

  • SHA512

    db4df82261a323b6c9947a6c2341e5926220cbf74d3477bf951e4635281cd84ee05c389543a4d2bb6381180836da58652871220eb7248c0728d6a6d2a20ede4d

  • SSDEEP

    384:QFX0YXgZqr5stZOG2TNM/ZfjIYi1or2RPxh8E9VF0Nys4t:ukYXss5ITsNiZfMYiKOPxWEma

  Score

  1^/10
  behavioral19behavioral20

• • Target

    ElectricLauncher/jre/bin/dcpr.dll

  • Size

    162KB

  • MD5

    ed5c8d6861339522e415c81927881beb

  • SHA1

    b37eb2c684641d6930ce57f9383f9f85b230a2d7

  • SHA256

    c7bd77f6d275af7220554578f92c897aef1cb2430a69a5277c33f3eb8be8c60d

  • SHA512

    24b48ec6b1b6773f7f5e852718d97c9e57794509790d2de786a028f1a665efea0855fa1a6cddfb22c1c8c1b08c3d4422383ea976182104236b0916e6fe07785e

  • SSDEEP

    3072:uXBbLdDu6+ACPg66h5vLpcDmojGylYCE2Iu2jGLF5A9bE8LUegTH/oxSn:YxkklK3GgYCE2L1F5A9bEGUeU

  Score

  1^/10
  behavioral21behavioral22

• • Target

    ElectricLauncher/jre/bin/decora_sse.dll

  • Size

    88KB

  • MD5

    c3cd959583f19c9a0695da619c4a2aea

  • SHA1

    e6ef5cf29d30f4a4f05dae1db018052473adf184

  • SHA256

    a66a3a6a3dd895947b55a8e57c142386b67f78e09bcb9e2de41ab48bc91447a3

  • SHA512

    392aa890310b372314e318eea5413a069bd29e02857e82ac3ccde09aadabeaa26d2fb4704bcd3f8f3d2597f0c0bb1fa58884c46e970affa326fbf6d3aee7fbc2

  • SSDEEP

    1536:2mPkTHoDu6TooFxWhNhPTOZVqH1Vs7BPxj:2mPkLdH2VqHPspxj

  Score

  1^/10
  behavioral23behavioral24

• • Target

    ElectricLauncher/jre/bin/deploy.dll

  • Size

    575KB

  • MD5

    721ff15668138e68056de8562f79fd5b

  • SHA1

    a9e109ec4ecfad1b2d0cc222e715633a588c0a89

  • SHA256

    4cd0833982648e6898951344beb6f93dadb30c962e8282bb12b4357663a26d77

  • SHA512

    4f6d5d1c7b40d693f49185aae375bb6c9a4d8deeee647cc25a38c3632dfdaf058cd1c76490ce3d84d6539164ec07abb1e799ffe78d3566f943bf134b4128d27e

  • SSDEEP

    6144:S4ZglQK7vma8fHTvs7wAFGoJYwzkkhJ4S8741+KxvxIW12:VZglJx8fcwAFGoJYwxb4Sxvq+2

  Score

  1^/10
  behavioral25behavioral26

• • Target

    ElectricLauncher/jre/bin/dt_shmem.dll

  • Size

    35KB

  • MD5

    c7b3c59250600043b8501098bdb38e84

  • SHA1

    22fb6d94523b15e048be32242b082a7b6d95b490

  • SHA256

    78973eb2698269ea6e52341ff1adedd6ff279e02aff5a03c67ffe96f88c5895e

  • SHA512

    e959397cd87440e15bcf3d8a9fbac5f75391d79eace7ac41fd21f97793f6339dfdd9e246595ead1e4e13f601595e348886c13640437a096b864b777365a46015

  • SSDEEP

    768:tUT9tCbTuGk7zIiWzKYvh2ZJWYii6PxWEQ0KB:tM9t+kWDh2ZI7i6PxwB

  Score

  1^/10
  behavioral27behavioral28

• • Target

    ElectricLauncher/jre/bin/dt_socket.dll

  • Size

    31KB

  • MD5

    37e3c00ea8d2622d358f51c7f7310c6d

  • SHA1

    0993f971a839f28ced2242bade7423cb58d24025

  • SHA256

    9b47b38fd8770e57e93bf4eafad30061f4fe5a6142a0ce78e159744866b03c8c

  • SHA512

    ee06ad2898be1d6b8c764b9011e36b2bc24c599efd26da8d6b2ea4d81d43d02f3ebe1ef7698a36760b042c9c407280d327f2fe711cd9279a3d4e7d70293ab390

  • SSDEEP

    384:5eWTpTKk19h9+S8sD+R2hgp4GbIYi1ottPxh8E9VF0NylzRVb:cW1pssa4o4GkYiYPxWEn7

  Score

  1^/10
  behavioral29behavioral30

• • Target

    ElectricLauncher/jre/bin/dtplugin/deployJava1.dll

  • Size

    1.2MB

  • MD5

    2c937101b876764ae379209d72120540

  • SHA1

    30ac1d97712cf9a56dc36176cee4ef398b6c395b

  • SHA256

    f258516d40b4ddce6fbb3da6791e71006aeca690b90e316e846d0336369cd1bb

  • SHA512

    966dde43cbaf7b905bbe24769b8d092ade97808028ad0fa346d10e02750bf893f57399d2ab3f2858d188555f36a66e1ff06fbdf88ca5a8de5fff8c59da6b5de1

  • SSDEEP

    12288:XXMEOOR48OLE3cvNvsV1wiAZSsrXxg0OSDDiU6ZJnL0oxQgSN2vChbOso6C6QJ1n:Xcg+8Qg2N0HwiAZhrq0OkDiU6ZJo2

  Score

  5^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral31behavioral32