Overview

overview

10

Static

static

10

skeet (1) (skeet).zip

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    skeet (1) (skeet).zip

  • Size

    3.5MB

  • Sample

    250101-eam9cswlhj

  • MD5

    4ec3431f372650d231b13b3688e62959

  • SHA1

    6380f8899ced0cde4d4347504ce63c5da49bd196

  • SHA256

    a67211d3d5d58e9193a6a99db1f44c05d96bf48f6f6589ea6d0b91f92233d611

  • SHA512

    138b799e10609bd10736348be67cce6ca951b895f9dce31ec978406da087ed90468da33553baafba1f62275e0211981d8b256225b1d826b877b96f980e5d65b5

  • SSDEEP

    98304:QHJEPWBVNTfNSrTV8h/kUvHvj6pdDZYFkoXXCPBZMnYPJ2k:QHJEPWHNT1STVavsqFkonsBcMYk

Score
10/10
umbraldiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      skeet (1) (skeet).zip

    • Size

      3.5MB

    • MD5

      4ec3431f372650d231b13b3688e62959

    • SHA1

      6380f8899ced0cde4d4347504ce63c5da49bd196

    • SHA256

      a67211d3d5d58e9193a6a99db1f44c05d96bf48f6f6589ea6d0b91f92233d611

    • SHA512

      138b799e10609bd10736348be67cce6ca951b895f9dce31ec978406da087ed90468da33553baafba1f62275e0211981d8b256225b1d826b877b96f980e5d65b5

    • SSDEEP

      98304:QHJEPWBVNTfNSrTV8h/kUvHvj6pdDZYFkoXXCPBZMnYPJ2k:QHJEPWHNT1STVavsqFkonsBcMYk

    Score
    10/10
    umbraldiscoveryexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks