umbral

General

Target

botCreator.exe
Size

488KB
Sample

240930-tc3jdsxfmb
MD5

668d42a2877f3c06ca17a413325174d4
SHA1

697e43404eb5e6a36f529cdd96321956ac809b3e
SHA256

4c19159d4f39a778bc189a23249cbb1f3985e8203dea388aaffb0493c64d7763
SHA512

b475b3e505d76e99f0d3de5214633749cfb62b724a71797440a383ddc08c6e8b82ca9dfa411a2c8c8cec7e5aa10c24d9d8b8dea31fb20d2b58e73de1f43962ed
SSDEEP

12288:WoZ1tlRk83MlrfFwiAfboTxUyzzq4HRPVgk9dRv/:f5r3YFwiAfboTxUyzzq4xPVP

Score

10^/10

Malware Config

Extracted

Family

umbral

C2

https://discordapp.com/api/webhooks/1288535835079344301/HEpgHUpDiIFl5481YNi5jv8F5_qF57Hba6FE-0-w8WH7_ISxKXYv9xOh1T32GN3zhvR0

Targets

- Target
  
  botCreator.exe
- Size
  
  488KB
- MD5
  
  668d42a2877f3c06ca17a413325174d4
- SHA1
  
  697e43404eb5e6a36f529cdd96321956ac809b3e
- SHA256
  
  4c19159d4f39a778bc189a23249cbb1f3985e8203dea388aaffb0493c64d7763
- SHA512
  
  b475b3e505d76e99f0d3de5214633749cfb62b724a71797440a383ddc08c6e8b82ca9dfa411a2c8c8cec7e5aa10c24d9d8b8dea31fb20d2b58e73de1f43962ed
- SSDEEP
  
  12288:WoZ1tlRk83MlrfFwiAfboTxUyzzq4HRPVgk9dRv/:f5r3YFwiAfboTxUyzzq4xPVP
Score

10^/10

umbral stealer discovery
- Detect Umbral payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Umbral payload

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2