Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1856f48b78...3N.exe

windows7-x64

10

1856f48b78...3N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1856f48b7896bca66780a4f7acdce1a4598b6a112f21cba787c9ec6da8d69ec3N

  • Size

    227KB

  • Sample

    241106-l5wybayepm

  • MD5

    b7142439fd3f0f3770ebf0021a8b9d40

  • SHA1

    2f258bfaca9191ec7cc266064da36e41fe839449

  • SHA256

    1856f48b7896bca66780a4f7acdce1a4598b6a112f21cba787c9ec6da8d69ec3

  • SHA512

    861d54ed93f3adb65ed9d2d0759f5e144841572b648a3129b90621cfda5c836264527979407ec0d4d2e9c511ef8445361fc53a8c4cea44f725e74caccd744eed

  • SSDEEP

    6144:+loZM+rIkd8g+EtXHkv/iD4t+Yxhv0IHd2PxM4d0ib8e1mxYi:ooZtL+EP8t+Yxhv0IHd2PxM4dDwh

Score
10/10
umbralstealer

Malware Config

Extracted

Family

umbral

C2

https://discord.com/api/webhooks/1271171461423562873/UcwkdS8pW8NPWN8bqEKxj1C2jviOZJjyf6WY_8iCbVGcVQS_don1IMdDKBJ56R7Jk7Tp

Targets

    • Target

      1856f48b7896bca66780a4f7acdce1a4598b6a112f21cba787c9ec6da8d69ec3N

    • Size

      227KB

    • MD5

      b7142439fd3f0f3770ebf0021a8b9d40

    • SHA1

      2f258bfaca9191ec7cc266064da36e41fe839449

    • SHA256

      1856f48b7896bca66780a4f7acdce1a4598b6a112f21cba787c9ec6da8d69ec3

    • SHA512

      861d54ed93f3adb65ed9d2d0759f5e144841572b648a3129b90621cfda5c836264527979407ec0d4d2e9c511ef8445361fc53a8c4cea44f725e74caccd744eed

    • SSDEEP

      6144:+loZM+rIkd8g+EtXHkv/iD4t+Yxhv0IHd2PxM4d0ib8e1mxYi:ooZtL+EP8t+Yxhv0IHd2PxM4dDwh

    Score
    10/10
    umbralstealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks