Extracted

• • Target

    DisconnectLoader.exe

  • Size

    299KB

  • MD5

    6f707167a736591abbb6a453091d603a

  • SHA1

    1daae281747491ef077374692bd36e2295b6c77a

  • SHA256

    bfa63de5ca4b0e7b032572781b333bbb802853254178c407ea2f0ae9ed163992

  • SHA512

    2e49078c2b788fa224c774a5ea8388705d768a0945de7f287f5c148a71739020dd5c247499d367ef391e8e35e3ee9339ebee3a0c1612ff652c04b02a68fc3268

  • SSDEEP

    3072:9ufodFK9MuOjio2QAsSdADRq6ty71wtYM77ldY7AXTp2kA3:9rK9BouwH77Ppj0kA

  Score

  10^/10

  umbralxwormexecutionratstealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1