General
-
Target
Nursultan.zip
-
Size
217KB
-
Sample
241102-xlxahssjgy
-
MD5
86fe8178d8df9d23afbbf47e5b21f5f0
-
SHA1
106ba426a9739b6320724737cffaa14b5e1d2f2c
-
SHA256
c503ac57785984abc5440e07c0fa2c16eb83b33b56fcdd232797285e712a8fb7
-
SHA512
6216d9a7dd091a8349a4706e3440e273b17c1a833845973056ef78f3a7845dbbd1d8fccfd57cd508c0a80ba548b607b1bfdffc4594ced7176d5a080370fd31a5
-
SSDEEP
6144:zAW8AvR3auno/wHVB5ntv+Vmnu4k6WqEgs6Qe:XRRoCVHR+Mnu4sqHs6d
Malware Config
Targets
-
-
Target
Nursultan.exe
-
Size
18.0MB
-
MD5
5878d63d3f8a1f0dd1c17785a0be6527
-
SHA1
a5070c225197ced6dffbd6ac7e07f0684b1494fa
-
SHA256
30dee505f1e0ed6775e7db746625146df390188525c6829f8e97120c7a1abf1d
-
SHA512
79c4529ca0e45d9bf803f2b070823bda9ea2d4098bb093074deffb9b2c5e453df19e22acd53490463c073b01e39b536b4fd3b7551d8eba24512dee1d21c4788b
-
SSDEEP
6144:Q4+P/wHVBnnt/B2hz3GNZUBhndmJJ7tFpY:mCVxz2hz3QUbdmbt
Score10/10-
Detect Umbral payload
-
Umbral
Umbral stealer is an opensource moduler stealer written in C#.
-
Umbral family
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-