Overview

overview

10

Static

static

10

Everything...p2.exe

windows10-2004-x64

10

Resubmissions

11/04/2025, 11:18 UTC

250411-ner8jsxnx2 10

11/04/2025, 11:16 UTC

250411-ndjj1sxtdy 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Everything-1.4.1.1026.x64-Setup2.exe

  • Size

    468KB

  • Sample

    250411-ner8jsxnx2

  • MD5

    53e560338b0fabac1c89e7baf950046d

  • SHA1

    517c82342d0e5ee0a581ff0db0e543c9cb9986a4

  • SHA256

    c9d2459c5bd3e5044d4d625f92e30bfa475e11fe259fc00c0d4961f5ebe10f3b

  • SHA512

    4216abf6d385c3f37889300dd9c8ec98215e7f8810806b2a306cd6e79747c720972b74026917ed5cc9a07e8c677aed2ad2ffc509290853eaa0ec4bc807a3843d

  • SSDEEP

    12288:hGePVle8y4TKs/u6oZtL+EP855eLcCFdW8j+ctBIX0B:oITKoI8XeLcCFdW8j+ctBIXo

Score
10/10
umbralcredential_accessdiscoveryexecutionspywarestealer

Malware Config

Targets

    • Target

      Everything-1.4.1.1026.x64-Setup2.exe

    • Size

      468KB

    • MD5

      53e560338b0fabac1c89e7baf950046d

    • SHA1

      517c82342d0e5ee0a581ff0db0e543c9cb9986a4

    • SHA256

      c9d2459c5bd3e5044d4d625f92e30bfa475e11fe259fc00c0d4961f5ebe10f3b

    • SHA512

      4216abf6d385c3f37889300dd9c8ec98215e7f8810806b2a306cd6e79747c720972b74026917ed5cc9a07e8c677aed2ad2ffc509290853eaa0ec4bc807a3843d

    • SSDEEP

      12288:hGePVle8y4TKs/u6oZtL+EP855eLcCFdW8j+ctBIX0B:oITKoI8XeLcCFdW8j+ctBIXo

    Score
    10/10
    umbralcredential_accessdiscoveryexecutionspywarestealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.