Extracted

• • Target
    5taj-v2.exe
  • Size 1.5MB
  • SHA256 9df581a6de7e02d2472fe55adb8d2100ee69c1827827da260f2f33792582e67e
  • MD5 72c270b31b3e63f4ab97bbc2636a66d8
  • SHA1 25147ede3e895f1be707b5ee28f8f9d41cd7d073
  • SHA512 9354c84a54342b9b7f2a170160a2de2290ebbc54436da795b8c1dbe99a11c8a16dd2c00aec7e83f17f602aaab97aafe7f94e6589881c6593d4242aab37c1509f
  • SSDEEP 24576:MobTMBp/I5rH3j6Z0Jm4lcnh83zuS+mTHkHnIXBAoCz6ytgaimQ1DVTrxnmj3yaq:ZbTMBqFj6Z4nlaDShhm0y2aXQZVThmjc
  • TLSH
    T12E7533E852E4D13FEEE1117056BAD5549D7BEF4162CD980F91F88AB107E1CB98E23232
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryumbralstealerdefense_evasionexecutionspyware

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2
• • Target
    AnyDesk.exe
  • Size 2.1MB
  • SHA256 b458e0ea38c9f621a82990830a348995bf5c47482f4b6cf7406bfe58ce8839e2
  • MD5 88ff2f8db6ad2b211bb995b78f63f4af
  • SHA1 22532e6ba0ce6d4b41aae571a52c929737764b8b
  • SHA512 ad1c660824add4456c9bc3128178a1947809f7c68ea9315b6c76562bf805f750f628db92e8548a3e941991c43886d6e5925becddc366d36662122802a5dce986
  • SSDEEP 49152:R5k6zR2xnyPVugq1NTxoPCdIA1sITLl3oKJ6mEO2lJYncq:/4Xxoo
  • TLSH
    T1E5A5C0B972582394D15AC8348523BD07F672391907B486DB37EAF5D02FAB2909F36B13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Umbral.exe
  • Size 229KB
  • SHA256 343e97e593d51b3c2f613ff85216adb9737812394509367db9d6ae9cd1f094aa
  • MD5 6ae3ee0557ead69970f7b53eafd0a302
  • SHA1 f8f49722ae4c054977dfe6d5cf7ab25dc0dd0ac7
  • SHA512 4927f56bf90b06dbb7861475a9762e936a0b8355b3f487c9c92e7c89a1a2cc7babed1fd038e6a131309cd96d06cfdc2f51550b7582f49d1a23b91cd02d46c305
  • SSDEEP 6144:tloZM3fsXtioRkts/cnnK6cMloVT7BPUonCWvRsY99Yb8e1mRi:voZ1tlRk83MloVT7BPUonCWvRsY9if
  • TLSH
    T1C8346B4933B88F17E25F8BBDD5B0549F87B1F143E90AF78E0C8899E82411B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  umbralstealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6