Overview

overview

10

Static

static

10

nitro tools/nitro.exe

windows7-x64

10

nitro tools/nitro.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nitro tools 1.1.rar

  • Size

    100KB

  • Sample

    240908-19acfayakk

  • MD5

    254aefe10fbebafb6e3b679388c12804

  • SHA1

    3a1f8a9aca3980e1989680ba4ee75bb8bc0b99c4

  • SHA256

    6c6da4b4abbff60565c105df74c4945474e08de70bc0feb7fbb13a157b1fbac2

  • SHA512

    2df66b0c4a3d32385f732191251e50e8abd2872268396cc6e015e3c296db466b4fa84602280c0e791bd1bf29da93ab3defa6cfa25a9f4ffe3223be9151dc9820

  • SSDEEP

    3072:qCrvnGpoocaqG1wRpTywo6cgcR8bUOaPevmlmivqE:lipoL28pTWucR84OaYUmeD

Score
10/10
umbralstealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1278735524693016678/rVaJ6RIY-ETw1qf7ojTh_6jWaVGdg2fBRNXv386RU_0FL_w3ueO8Kp_DbYxSHjD5WZEw

Targets

    • Target

      nitro tools/nitro.exe

    • Size

      254KB

    • MD5

      943a2791a4d420fe5419e7a712b2389b

    • SHA1

      00a02e7b5061dd71b16c2be8b14449bf4064f076

    • SHA256

      9708125c30cd5a908da8bacd3e96869207dee7d0f8327eddc7f59fd329972f1a

    • SHA512

      99d8b32aeb0ca7677fd20ba58eb81b34c745bf7c9498d48b56f87804018f7ebc016ed043e376a876e4b4b1ae8e4b9daef6e215f3b61683936cb14b92fdf2f9f2

    • SSDEEP

      6144:K4oZoAeVHPtHgTIAaZgCwDx7axHU0unC28ejI8l7:xoZyHPvWCwjXCsI0

    Score
    10/10
    umbralstealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks