Extracted

Extracted

• • Target

    94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8

  • Size

    1.9MB

  • MD5

    477ee009f176249987f15c8fd01902f0

  • SHA1

    c40e6e81adcca5bf643ea005e3e2bc062793985d

  • SHA256

    94a9aea0d58aed1c57e0f3857ea7de65778a6faab1912e4decbe463bf7b85ae8

  • SHA512

    aef7538f615ec5607f56f41f17ad045a4ac8bba6e7a27e185068208a7ea704c01b1b87aaae0b5cb42f2e61ee11dd344e01c2f8d2d089a026e14931935da6dfef

  • SSDEEP

    24576:IRDdNQlDWcG0ZbOOdezYwITkHiPIZp7WAvck0poRtf0BJngtcp90kcTFI8A+W4+u:IRDTQRzMKeEcHLZkA0ruJd/

  Score

  10^/10

  umbralxwormdiscoveryevasionexecutionratspywarestealertrojan

  • Detect Umbral payload

  • Detect Xworm Payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2