Overview

overview

10

Static

static

3

2026-05-11...ti.exe

windows10-2004-x64

10

2026-05-11...ti.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-11_4c0bfded95309c9fdb6608aa5d7f8683_conti
  • Size 251KB
  • Sample260511-e8qgdaex7p
  • SHA256 7919393c986837214d6176929503191b0eaba88f6d59a93bedaa4b4e683934d8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
umbralstealer

Malware Config

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1503127229838655498/yW6stOxEO6MSuCT5qcEuxAGVYHehJUHcWg1SFAK1gZZL8kdL4OaHd5LICi_1AsVD0WSd

Targets

    • Target
      2026-05-11_4c0bfded95309c9fdb6608aa5d7f8683_conti
    • Size 251KB
    • SHA256 7919393c986837214d6176929503191b0eaba88f6d59a93bedaa4b4e683934d8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    umbralstealer

    • Detects Umbral payload

    • Family: Umbral

      Umbral stealer is an open-source modular stealer written in C#.

      stealerumbral

    • Detects executables attemping to enumerate video devices using WMI

    • Detects executables containing possible sandbox analysis VM names

    • Detects executables containing possible sandbox analysis VM usernames

    • Detects executables containing possible sandbox system UUIDs

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks