Overview

overview

10

Static

static

10

Umbral.exe

windows10-ltsc_2021-x64

10

Umbral.exe

ubuntu-22.04-amd64

Umbral.exe

debian-9-armhf

Umbral.exe

debian-9-mips

Umbral.exe

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

  • Target
    Umbral.exe
  • Size 231KB
  • Sample260623-vekl2aet4l
  • SHA256 72d66cfb467695628b20ed32284ece95fe03b644128fae93d77cf4cc7b0d640b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
umbrallinuxstealer

Malware Config

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1518960384470552736/JRA1xetJzZs2UUO1pavVmYbnFGI1IFd4vyvAon_490ce8KZ4gWRnpJ81agX_-vr4yvjh

Targets

    • Target
      Umbral.exe
    • Size 231KB
    • SHA256 72d66cfb467695628b20ed32284ece95fe03b644128fae93d77cf4cc7b0d640b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    umbralstealer

    • Detects Umbral payload

    • Family: Umbral

      Umbral stealer is an open-source modular stealer written in C#.

      stealerumbral

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix

Tasks