Overview

overview

10

Static

static

10

Wave/LICEN...m.html

windows7-x64

3

Wave/LICEN...m.html

windows10-2004-x64

3

Wave/WaveWindows.exe

windows7-x64

10

Wave/WaveWindows.exe

windows10-2004-x64

10

Wave/d3dco...47.dll

windows10-2004-x64

1

Wave/ffmpeg.dll

windows10-2004-x64

1

Wave/libEGL.dll

windows10-2004-x64

1

Wave/libGLESv2.dll

windows10-2004-x64

1

Wave/resou...DME.js

windows7-x64

3

Wave/resou...DME.js

windows10-2004-x64

3

Wave/resou...dex.js

windows7-x64

3

Wave/resou...dex.js

windows10-2004-x64

3

Wave/resou...DME.js

windows7-x64

3

Wave/resou...DME.js

windows10-2004-x64

3

Wave/resou...ten.js

windows7-x64

3

Wave/resou...ten.js

windows10-2004-x64

3

Wave/resou...DME.js

windows7-x64

3

Wave/resou...DME.js

windows10-2004-x64

3

Wave/resou...dex.js

windows7-x64

3

Wave/resou...dex.js

windows10-2004-x64

3

Wave/resou...ead.js

windows7-x64

3

Wave/resou...ead.js

windows10-2004-x64

3

Wave/resou...son.js

windows7-x64

3

Wave/resou...son.js

windows10-2004-x64

3

Wave/resou...raw.js

windows7-x64

3

Wave/resou...raw.js

windows10-2004-x64

3

Wave/resou...ext.js

windows7-x64

3

Wave/resou...ext.js

windows10-2004-x64

3

Wave/resou...ded.js

windows7-x64

3

Wave/resou...ded.js

windows10-2004-x64

3

Wave/resou...DME.js

windows7-x64

3

Wave/resou...DME.js

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e8f4c775fae9142fbd5d05be825c412f95df7c19cf93b3bac543a746fba0aa07

  • Size

    63.7MB

  • Sample

    240913-xp9p1stajr

  • MD5

    69f7d7ee2c09e422cd36e9cf24aa7858

  • SHA1

    9405fdde54e7bf91a82f90b3b209f5c0aa67d476

  • SHA256

    e8f4c775fae9142fbd5d05be825c412f95df7c19cf93b3bac543a746fba0aa07

  • SHA512

    0fd5d5779d373142f3503c2f6507ffebb88383585b90bbf9a9163e1081675a148968a5950e5639f1e1a83ef301092d7f1c26b923ae8f5ab9b596f0b8ff9074dc

  • SSDEEP

    1572864:DQjGCbB02F1ir8Q9zeIGmVhm3QtY6IMXVmbLG3xBpu3A/pTP:cjGCbB5FGBeI5VrIdHGhBCAR

Score
10/10
exelastealerumbralcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1284109352877428746/ynYxJ7LoUnQYDiMVawzxesm3MoVdr_2vbNfl-vna_xyFrDmgWu6L7UCN0tMvtbReFJJ8

Targets

    • Target

      Wave/LICENSES.chromium.html

    • Size

      9.0MB

    • MD5

      aaea51a605688fcb2f178fd60e4ca64c

    • SHA1

      69d4791bf3cfedb68bc4d8f766878103578171cb

    • SHA256

      96837a4a521a61bd3d34f2f660e29902d228aaec501eeb2a84403f1926c3df9d

    • SHA512

      d328bf2f9ff7372a716a09e5882b9e3c0051b0135412b3258453085db1de2c7699c8aae24edfaca7798f468802db975977c9976e19fca84fffe884bf8594c33e

    • SSDEEP

      24576:h+QQf6Ox6x5n1nZwReXe1GmfL6k6T6W6r656+eGj/dBIp+:oAZeGLp

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      Wave/WaveWindows.exe

    • Size

      27.9MB

    • MD5

      2d0703acbed8003c7afa9f08f702f251

    • SHA1

      35181a175abe31f337f1d2ec83da735d70f327fe

    • SHA256

      147c4eb6a5c1235c21a1bed6f352eb257c15747309b618e993442f04a4e613f4

    • SHA512

      aefcfbeba017b7a56edce41a8ddcd4fd6b410819ae760cdf7990a3f2e9d16654ad5587e49678cdc97e9a8f9487a568721479b1fc52b12d9a7f639d1c6a4a4c02

    • SSDEEP

      786432:07vDACrv3Fqbq0ohQivGgPQEErUlqsAN50hO:07v0eqbVwQEG89EdN50hO

    Score
    10/10
    umbralcredential_accessdiscoveryexecutionpyinstallerspywarestealerupxexelastealercollectiondefense_evasionevasionpersistenceprivilege_escalation

    • Detect Umbral payload

    • Exela Stealer

      Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.

      stealerexelastealer

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral3behavioral4

    • Target

      Wave/d3dcompiler_47.dll

    • Size

      4.7MB

    • MD5

      a7b7470c347f84365ffe1b2072b4f95c

    • SHA1

      57a96f6fb326ba65b7f7016242132b3f9464c7a3

    • SHA256

      af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a

    • SHA512

      83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d

    • SSDEEP

      49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc

    Score
    1/10
    behavioral5

    • Target

      Wave/ffmpeg.dll

    • Size

      2.6MB

    • MD5

      74f026c54ba86deb1b4b37bb52ccebb6

    • SHA1

      760f097ee5a115908644d411ded703d4f8391528

    • SHA256

      16261687febd0d707c7b90eeb802b3befdec9b20c4fbd29068540c2b94c81de6

    • SHA512

      761cc81df52c82e72575737a329a5e56fd443b2a9f2c47159b3b7236453c3931dcdf19f3debc5a9d506c76f1b5f85f8f197ea9da4d15b5a55246316edb07c1a6

    • SSDEEP

      49152:u1nRu1gjn93AXtsX7I8g4AScbz6Ox+pen6yfmb+ST1PqRrYw:uJsf83Sn6Ox+tP5w

    Score
    1/10
    behavioral6

    • Target

      Wave/libEGL.dll

    • Size

      470KB

    • MD5

      11dd0e3751c4c8313da6cbc8a5ebc5ee

    • SHA1

      f86c4e728fe0ba34bd7d8caee5a26b06b410fab6

    • SHA256

      18cca9a1952e2699a955690b8a870e614c28321a4e032392f8526677b5712f98

    • SHA512

      251d49decca237b2e28f59a58fc4f443970d992a40e1cd7f15ff21630f156c9b05d0ac2a94e0a11bfd9e6488e656f4785c2151e9cad62cd569c4e4cae4c66f23

    • SSDEEP

      6144:zmi12qlTgeUDsnkcM2nDl83BgENhYCqN8fY24M:zmk2qxgeUDsNnDcgENhYRN8fU

    Score
    1/10
    behavioral7

    • Target

      Wave/libGLESv2.dll

    • Size

      7.7MB

    • MD5

      28fb9a36dff35a20393d938be73b0485

    • SHA1

      9326cec7184c0e90fa9a6523c862a46171e69137

    • SHA256

      ce43b08039628c9969345fdf0861f7633faa9a00356173e6c170dc437353a2b3

    • SHA512

      8b1e08e10035ccafbd6c1a145757d9f2c1b57190bb0e4a342fd62017798ed9259264b7ea178db16698c70e50856a1a6381a38248d683756a4e7680b39664c44e

    • SSDEEP

      98304:MPqhbsPD8TDyGDsTnI5mvmKGtS17QXC3O:MP4m8TDyluKGugmO

    Score
    1/10
    behavioral8

    • Target

      Wave/resources/node_modules/accepts/README.md

    • Size

      4KB

    • MD5

      873e624d40d23cf9b54f9d2f74d2c8d1

    • SHA1

      3a884510d2eeed73a4cd5ae0947a6c72cd3c7426

    • SHA256

      c25a1071e5aa1b1b43e10f083e8d97c3dbf1f7700cfa38b5cbc40725662e1ae0

    • SHA512

      a929edeb59edc6f1ef4f7554ddfd0b1b54aa097d4fdf69c5ec25b14c3c722a034d159daf3ad38508efc775fdf8c246507d53021e4ad79f0708c5df94b311a864

    • SSDEEP

      48:ZdC9AIvI6RZK0nwuBGWxGWwsNdXMoNjP601Wrk0aN8F07DaN89JC7aN8fBfuRhpL:/CnQl0JZ15jue/9IQxokXjwiA0

    Score
    3/10
    execution
    behavioral10behavioral9

    • Target

      Wave/resources/node_modules/accepts/index.js

    • Size

      5KB

    • MD5

      4fe4d2c90a2fd19d6e97443a7d24f815

    • SHA1

      282263f45f6bf80fbf43f4097d53b5b60ff1a05f

    • SHA256

      be2decbd50610e8f995c1e312ee4dd6d7c1244cfdf03ee4c4a3da68e572dada1

    • SHA512

      c795b7285cc92616a46fd1ad2d00ce65fb4b269e6b6fc35315891d119b7c25b7f4573540be0627d577123201d9cfe119c8a53f0e75a8b6ea870f8d89a130c213

    • SSDEEP

      96:oYG1MGmGHqyl8rAyBkmqFxo+uerpDWMlB8fdOGUJTit4UG9bCZhPwA:oYG1Xlqyl88yBD+uerRLD0YQ4rcZh9

    Score
    3/10
    execution
    behavioral11behavioral12

    • Target

      Wave/resources/node_modules/array-flatten/README.md

    • Size

      1KB

    • MD5

      328fdaf1ee65869341567f4fb6716e02

    • SHA1

      98efa9e4bd6d6bca4ebb76991a2187a8a496c8b6

    • SHA256

      071dd896356da12269508f361958ec622e47b27a96d7efdba23b671bc3470416

    • SHA512

      40378eeeb21474e8be2962853b1d279ab8e167e68ebad08ae4e7932c131da317672852916bcc1000ec43a0163653c45158a9a8be819b4a6479163ac8c5391ca5

    Score
    3/10
    execution
    behavioral13behavioral14

    • Target

      Wave/resources/node_modules/array-flatten/array-flatten.js

    • Size

      1KB

    • MD5

      4b17fa06c54846b686b8b799e9dd253a

    • SHA1

      fc6cc30e8b8ec09eeba62bac076ed627aa3ee8d1

    • SHA256

      766ca145b6d25e3d60f352a716e8fa1876bcdf362c0767c360cf24f335bc281e

    • SHA512

      72df1668f464f6942c484155b667086bb6f83f77e826ffcd146ee045079db3334aba270bffb66cdd796d4c9308121ec2a67a404289f19914c45d9a6c15435e71

    Score
    3/10
    execution
    behavioral15behavioral16

    • Target

      Wave/resources/node_modules/body-parser/README.md

    • Size

      17KB

    • MD5

      3152126cd7d54ede5697046e69a7e589

    • SHA1

      3c8820c682cc2e043465d9aafbe1e182571e941f

    • SHA256

      1a8c31593d425887df10e400a765d3f86f3b195b4efdccd44ff4aa542c03380b

    • SHA512

      73b3c1fa28e96f744e7e6a58a13d6c5b31646cf06fe47895c226ed61198c5c2bcd4a2dc0c4447de54ea15d5d56d7e330ad1335b3659598cc576a88e791c16358

    • SSDEEP

      192:eBmKv7ygazeyidkShRvtlgem3x1A6H9wSu9kYPaDpIQVf3X/R0yV2aaX2JC/vuZA:xKFO4d/63TA6H9i9bSDKqvXpqmC

    Score
    3/10
    execution
    behavioral17behavioral18

    • Target

      Wave/resources/node_modules/body-parser/index.js

    • Size

      2KB

    • MD5

      b9e991c0e57c4d5adde68a2f4f063bc7

    • SHA1

      0cb6b9eb7b310c37e5950bbcaf672943657c94b5

    • SHA256

      9c6c900e7e85fb599c62d9b9e4dfd2ea2f61d119dce5ed69ac3a8da828819241

    • SHA512

      3bbd31eed55c32435b01fe7356d39749e95f8f49222115ada841e751ad36227e6f427efdc4e8bad36d8ccd37c2e92c01fa67c24c23f52023df8c1e1be1a3b4f6

    Score
    3/10
    execution
    behavioral19behavioral20

    • Target

      Wave/resources/node_modules/body-parser/lib/read.js

    • Size

      4KB

    • MD5

      c148bb38c59ce266e271c96ab1f2d192

    • SHA1

      027f3fbd8a5370ddec744d33ec9d594db41f6293

    • SHA256

      1e9e274755366c39ae70e8b9a7a42fc12219566e67efaf9b7ebc2a8b337f5b6b

    • SHA512

      bc4779cda1a3b130eb8cf76bb40676046ceb514ddc5c1891d7324776e6188e5d5ceb4c0799cf2fbc007786849ed07903cb59f61ffcac407300eef0a16cb7c498

    • SSDEEP

      96:1F2ISKMGJ0n9WbOaHSb+IR1+GFQBnPQCbfkZ/OPqgVB9OuCyMQ:1FwZYbhHSb9R1+GFQBICbfkWVBqlQ

    Score
    3/10
    execution
    behavioral21behavioral22

    • Target

      Wave/resources/node_modules/body-parser/lib/types/json.js

    • Size

      5KB

    • MD5

      6b036408f968978bf9668496db9953ba

    • SHA1

      af1f14428152576f1c047c3462d26a7feb98635a

    • SHA256

      44f8b529333004e2aaff6db3a1dbe7068f1ac5fa1173e9634686a78c2262af35

    • SHA512

      89bef97d3d5d0c8da0f3aa1e178fee1d04eee5200c2f037bd55761a61e6c6a251f7314e82343761ef227a997909f4a0237a3ff5f79a1a7bb9e879a465ab84f86

    • SSDEEP

      96:1F+Graz+dz1PbSDp2qjlvqzi+QBYwxcG5l+NbkAZiVl7g6A4QYSR:1F+Graz8TUj0mx+wOgybriVZg6ffSR

    Score
    3/10
    execution
    behavioral23behavioral24

    • Target

      Wave/resources/node_modules/body-parser/lib/types/raw.js

    • Size

      1KB

    • MD5

      acb38e4fe575afaf8d1a257e47c6e362

    • SHA1

      ea7411ff5a71df8d426322d07103e5894630e29b

    • SHA256

      4e9cc80a7ee8bd667c68c264b4c374b28e731246ddb6ec22c3968daf837e30a2

    • SHA512

      157427ad25390339b045b9bb81753709498b69b2cc8b9c918c19d52d1cb4f6bbe5b6b07885d0a7f66ef359b7080dc9a42216f71911b08ade04c1a112192bff50

    Score
    3/10
    execution
    behavioral25behavioral26

    • Target

      Wave/resources/node_modules/body-parser/lib/types/text.js

    • Size

      2KB

    • MD5

      beb4ada09306f8d6435566d9e88076d3

    • SHA1

      eda9bc036c9d10f1400cd2e4a8832949671cadc7

    • SHA256

      54a6e8ef720b06a300b21f6c60387805dec743a64154784a609dfe8c6860776a

    • SHA512

      5d9c9c6837b9599d29db9b1eb54cd2a4e215feeb028137f31c20f2b02e38f600aa8c02721444dc41d7bfc206ad39a810076853d09fa1e3113b5708a75443131e

    Score
    3/10
    execution
    behavioral27behavioral28

    • Target

      Wave/resources/node_modules/body-parser/lib/types/urlencoded.js

    • Size

      5KB

    • MD5

      906a833480ce8841bfa5aeb95b5c085f

    • SHA1

      8f74a7d616bf363b78844d3bcc2f554d7c76a952

    • SHA256

      752717d87aad57451638af2073b04eba964f348910c0bcf0070c43e732de5eb2

    • SHA512

      7676871dd3012dad0472be51698d9d1677622ba3d392417a41d22ef7f6d7df6c8085516bb9bdc45d4f125815161899aa889d756d18cd41f11e2402e659f7934d

    • SSDEEP

      96:1F+GrIE8S/wtosB5XaYp2Yy+QBYwxcGw+NbaZMz71LX7g6KspqOJUICK0mMQ7eLR:1F+GrIE8S/wtoGXaUyx+wODybGMz7132

    Score
    3/10
    execution
    behavioral29behavioral30

    • Target

      Wave/resources/node_modules/body-parser/node_modules/debug/README.md

    • Size

      17KB

    • MD5

      03694893d682191b3c893701ba6f4a55

    • SHA1

      38096a9c10830714695a97a8501b817eb0a7534e

    • SHA256

      cda3dbd285a2b65894758565a565e7bc2e7c3696225af7b5bd01454240df0aea

    • SHA512

      3b80ea8a912ec4ddf1a1e2fc3f3ebd8f4bc6f591f9b2732694cb5627c549d7911c1a6eb82ab68ac025e13e090b3e39b8b4ae66a9159f45696b6343ce76213f54

    • SSDEEP

      192:H6R76Zbt7yJXxRrHQbSb4BDyzWM/XAoxIM6jep2JVhgu9o8ZT/ueXBEgdjaSjVwo:U7DxRrqB4rxIMajJVeqaxq3

    Score
    3/10
    execution
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Account Manipulation

1
T1098

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Permission Groups Discovery

1
T1069

Local Groups

1
T1069.001

Process Discovery

1
T1057

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

3
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

pyinstallerumbral
Score
10/10

behavioral1

discovery
Score
3/10

behavioral2

discovery
Score
3/10

behavioral3

umbralcredential_accessdiscoveryexecutionpyinstallerspywarestealerupx
Score
10/10

behavioral4

exelastealerumbralcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationpyinstallerspywarestealerupx
Score
10/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

execution
Score
3/10

behavioral10

execution
Score
3/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

execution
Score
3/10

behavioral30

execution
Score
3/10

behavioral31

execution
Score
3/10

behavioral32

execution
Score
3/10