Overview

overview

10

Static

static

3

gnp.scr

windows10-2004-x64

10

gnp.scr

windows11-ltsc_2024-x64

3

Resubmissions

02/07/2026, 04:28

260702-e32x8abx7s7

02/07/2026, 02:56

260702-dfgs4ahy4p3

02/07/2026, 02:54

260702-dd46lsbt5v8

29/06/2026, 14:02

260629-rcb1bse19t10

Sharing

Copy URL Twitter E-mail

General

  • Target
    gnp.scr
  • Size 581KB
  • Sample260629-rcb1bse19t
  • SHA256 ec3c8489436f64916d43500ca3d3ec4f0690048ec9c32400fc3198cd9904456d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
umbralexecutionpersistencestealer

Malware Config

Extracted

Family

  • umbral

Version

  • v1.3

C2

  • https://discord.com/api/webhooks/1520099424465060122/wgeVhfmpNhqbADLp7irzEVszvPbOOu_Mo821U5cLDSFvqJyPtGsj52XMFncN4nHM8j_c

Targets

    • Target
      gnp.scr
    • Size 581KB
    • SHA256 ec3c8489436f64916d43500ca3d3ec4f0690048ec9c32400fc3198cd9904456d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionumbralpersistencestealer

    • Detects Umbral payload

    • Family: Umbral

      Umbral stealer is an open-source modular stealer written in C#.

      stealerumbral

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks