umbral

General

Target

Nursultan.zip
Size

217KB
Sample

241102-xms99asgjl
MD5

86fe8178d8df9d23afbbf47e5b21f5f0
SHA1

106ba426a9739b6320724737cffaa14b5e1d2f2c
SHA256

c503ac57785984abc5440e07c0fa2c16eb83b33b56fcdd232797285e712a8fb7
SHA512

6216d9a7dd091a8349a4706e3440e273b17c1a833845973056ef78f3a7845dbbd1d8fccfd57cd508c0a80ba548b607b1bfdffc4594ced7176d5a080370fd31a5
SSDEEP

6144:zAW8AvR3auno/wHVB5ntv+Vmnu4k6WqEgs6Qe:XRRoCVHR+Mnu4sqHs6d

Score

10^/10

Malware Config

Targets

- Target
  
  Nursultan.zip
- Size
  
  217KB
- MD5
  
  86fe8178d8df9d23afbbf47e5b21f5f0
- SHA1
  
  106ba426a9739b6320724737cffaa14b5e1d2f2c
- SHA256
  
  c503ac57785984abc5440e07c0fa2c16eb83b33b56fcdd232797285e712a8fb7
- SHA512
  
  6216d9a7dd091a8349a4706e3440e273b17c1a833845973056ef78f3a7845dbbd1d8fccfd57cd508c0a80ba548b607b1bfdffc4594ced7176d5a080370fd31a5
- SSDEEP
  
  6144:zAW8AvR3auno/wHVB5ntv+Vmnu4k6WqEgs6Qe:XRRoCVHR+Mnu4sqHs6d
Score

10^/10

umbral discovery execution persistence spyware stealer upx
- Detect Umbral payload
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Umbral family
  umbral
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1