Overview

overview

10

Static

static

1

chrome pas...xt.lnk

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    chrome passwords.txt.lnk

  • Size

    2KB

  • Sample

    250323-sc1jcsykt3

  • MD5

    47668567f79882bddc96a52bc6c1fc89

  • SHA1

    7d0e69cff74fb5bd0e58d494c3f5eab815703f4d

  • SHA256

    2599b76e8efb52c183e141c5bbd92da2aefd767295b8579a40442415c8b7061a

  • SHA512

    71e57e3c278611e7f27d1fc4338297f04946f6e2dced678fdd05541f33524ee3d6c635a24e27f03e20064f8a9496f212b02193a241e3627b0b286d8d71c9cf5f

Score
10/10
umbralexecutionspywarestealer

Malware Config

Targets

    • Target

      chrome passwords.txt.lnk

    • Size

      2KB

    • MD5

      47668567f79882bddc96a52bc6c1fc89

    • SHA1

      7d0e69cff74fb5bd0e58d494c3f5eab815703f4d

    • SHA256

      2599b76e8efb52c183e141c5bbd92da2aefd767295b8579a40442415c8b7061a

    • SHA512

      71e57e3c278611e7f27d1fc4338297f04946f6e2dced678fdd05541f33524ee3d6c635a24e27f03e20064f8a9496f212b02193a241e3627b0b286d8d71c9cf5f

    Score
    10/10
    umbralexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks