Overview

overview

10

Static

static

3

Ref-Quotation.pdf

windows7-x64

3

Ref-Quotation.pdf

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ref-Quotation.pdf

  • Size

    7KB

  • Sample

    240806-vwyvzsvdqr

  • MD5

    3afee0850cb4ac806103dd7029c99dec

  • SHA1

    81db120f09c5ee62d785ea7fc76d2065362d8d3c

  • SHA256

    c00313aabcfd55989bbd839a80dcdd52fe4f08911bba68a5f9acfcc463cf8602

  • SHA512

    a410572f6aec8153fc5a6f5744ea9064d9730d6c6258a4ac5f244840105afb15fc726e0b9d4b0d28084aeb2dfceceff249b25bcd5b15f846fcc08e6a1004a502

  • SSDEEP

    96:YEcrIq5gt/vsHuMp18EtTkYVkZmsJSJlkOCKeLDkaITVIcxe4vnWcrV:2Iq5OvsppmEJl2rAZoDkj7nTV

Score
10/10
umbralcredential_accessdiscoveryexecutionlinkpdfspywarestealer

Malware Config

Targets

    • Target

      Ref-Quotation.pdf

    • Size

      7KB

    • MD5

      3afee0850cb4ac806103dd7029c99dec

    • SHA1

      81db120f09c5ee62d785ea7fc76d2065362d8d3c

    • SHA256

      c00313aabcfd55989bbd839a80dcdd52fe4f08911bba68a5f9acfcc463cf8602

    • SHA512

      a410572f6aec8153fc5a6f5744ea9064d9730d6c6258a4ac5f244840105afb15fc726e0b9d4b0d28084aeb2dfceceff249b25bcd5b15f846fcc08e6a1004a502

    • SSDEEP

      96:YEcrIq5gt/vsHuMp18EtTkYVkZmsJSJlkOCKeLDkaITVIcxe4vnWcrV:2Iq5OvsppmEJl2rAZoDkj7nTV

    Score
    10/10
    discoveryumbralcredential_accessexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks