Extracted

• • Target

    Umbral.exe

  • Size

    229KB

  • MD5

    05396af5253bb6dd42278b146668faac

  • SHA1

    44a769f9800ed7675b6b6bd57a6a123b6dc10371

  • SHA256

    eacb721b092e628a9699924dad19f4ea4ae1f3d7eb5dce85b5dcd16a273cd78b

  • SHA512

    3283964cff79c4fa5319f92bd429c19b0f99ae4a0f518a15882a132177eba60e2ed2ec0fbcfdf273e7e0be646b4f00cee0298a23bef5a83b1985029845f1b916

  • SSDEEP

    6144:lloZM+rIkd8g+EtXHkv/iD4FQpTNbYMTiqL9Y0hU9b8e1msBi:noZtL+EP8FQpTNbYMTiqL9Y0h8w

  Score

  10^/10

  umbralstealerdiscoverypersistenceprivilege_escalation

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2