umbral

General

Target

atomic.exe
Size

229KB
Sample

241014-yw3eystfqb
MD5

05f1e261fdb236fd899a48d71a5f33f1
SHA1

6a0399a6a8417616f5fd72e075712a54fbde4a6d
SHA256

15e734a6600467bdf53fb3e997151562f25797baa8e5688036240438a96ca1e1
SHA512

f637b0c54c8223a41961274cabe34e1d9b23e351e6f78658617785d53785e31ec33bdef700d7257ca9667420fafe6ec556d210fd5cf1f11d03b1b7443b923212
SSDEEP

6144:tloZMLrIkd8g+EtXHkv/iD4H4jwT5KyNo4ZL22jx9b8e1mrgi:voZ0L+EP8H4jwT5KyNo4ZL22jz2

Score

10^/10

umbral stealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1295100259101310996/NS6fhNZm5DSV0fiK2qgIelgdlX55DNAj9Ri9S4FVxmg782vpz-tRPZkMk5wT2PXlm2y4

Targets

- Target
  
  atomic.exe
- Size
  
  229KB
- MD5
  
  05f1e261fdb236fd899a48d71a5f33f1
- SHA1
  
  6a0399a6a8417616f5fd72e075712a54fbde4a6d
- SHA256
  
  15e734a6600467bdf53fb3e997151562f25797baa8e5688036240438a96ca1e1
- SHA512
  
  f637b0c54c8223a41961274cabe34e1d9b23e351e6f78658617785d53785e31ec33bdef700d7257ca9667420fafe6ec556d210fd5cf1f11d03b1b7443b923212
- SSDEEP
  
  6144:tloZMLrIkd8g+EtXHkv/iD4H4jwT5KyNo4ZL22jx9b8e1mrgi:voZ0L+EP8H4jwT5KyNo4ZL22jz2
Score

10^/10

umbral stealer
- Detect Umbral payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Umbral payload

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2