General

  • Target

    Xbox Checker By Xrisky - Copie.exe

  • Size

    231KB

  • Sample

    241019-w32e5ashkp

  • MD5

    8cf3944a211784c36345dbfe96567529

  • SHA1

    80d5f583adf017eb56a00182f39102aea138d23d

  • SHA256

    ed2f50ad609af7d19f742a8b431f93cf0b18c4cc0c9daf5d948855784b959d87

  • SHA512

    59db359989a353a29ae84bda4ca6ee1a6aa6d1352377166e679787663edf6c091e5db05bb9d0f14c6f201afc10915b0994bd1b5b9033d54a611c3a46273f3c3d

  • SSDEEP

    6144:xloZM3fsXtioRkts/cnnK6cMlGmOQPUM8e1mPpi:DoZ1tlRk83MlnbP1D

Malware Config

Extracted

Family

umbral

C2

https://discordapp.com/api/webhooks/1288206979218673764/RrS7iPbULk9GWtxJNyjCuCkWoPFV6vASvzEiK__wxKJujjsUExjFE4MUTWHKOi6jTFvN

Targets

    • Target

      Xbox Checker By Xrisky - Copie.exe

    • Size

      231KB

    • MD5

      8cf3944a211784c36345dbfe96567529

    • SHA1

      80d5f583adf017eb56a00182f39102aea138d23d

    • SHA256

      ed2f50ad609af7d19f742a8b431f93cf0b18c4cc0c9daf5d948855784b959d87

    • SHA512

      59db359989a353a29ae84bda4ca6ee1a6aa6d1352377166e679787663edf6c091e5db05bb9d0f14c6f201afc10915b0994bd1b5b9033d54a611c3a46273f3c3d

    • SSDEEP

      6144:xloZM3fsXtioRkts/cnnK6cMlGmOQPUM8e1mPpi:DoZ1tlRk83MlnbP1D

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks