Overview

overview

10

Static

static

3

svchost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    603KB

  • Sample

    250219-svpvkstlbw

  • MD5

    cbde7887e32b1c0837b4f5feaccfd19a

  • SHA1

    979443ec0ee69c4aa59ba87b7fe631f733f39a68

  • SHA256

    20367536f2263f53c3a52f574cbe883e539c7b2fb6cf344c8e1c9f6ed69c8c6c

  • SHA512

    a8dbf07713cb6773df248f13b387f9edca8083a4f838b82fbfb571a107cd28125138174192f1dd5fa3dce3ed64cfcbb1ae5be1d96a55261b8621005012f050f8

  • SSDEEP

    12288:5LQcwNyJ6oF2FqYTchKt8RjIxEWhD8Tr+38DijMCsiHzBQ:5LGNumChKt8RjOEE8Tr+32yFQ

Score
10/10
umbraldiscoverystealer

Malware Config

Targets

    • Target

      svchost.exe

    • Size

      603KB

    • MD5

      cbde7887e32b1c0837b4f5feaccfd19a

    • SHA1

      979443ec0ee69c4aa59ba87b7fe631f733f39a68

    • SHA256

      20367536f2263f53c3a52f574cbe883e539c7b2fb6cf344c8e1c9f6ed69c8c6c

    • SHA512

      a8dbf07713cb6773df248f13b387f9edca8083a4f838b82fbfb571a107cd28125138174192f1dd5fa3dce3ed64cfcbb1ae5be1d96a55261b8621005012f050f8

    • SSDEEP

      12288:5LQcwNyJ6oF2FqYTchKt8RjIxEWhD8Tr+38DijMCsiHzBQ:5LGNumChKt8RjOEE8Tr+32yFQ

    Score
    10/10
    umbraldiscoverystealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks