6c5375dc963a3ad5bbbf635fb0704b8c37276393917a5eb52cd1a3d6952b44ed

Sharing

Copy URL Twitter E-mail

General

Target
Umbral Binder.rar
Size 7.0MB
Sample260715-m3tkvaas9n
SHA256 6c5375dc963a3ad5bbbf635fb0704b8c37276393917a5eb52cd1a3d6952b44ed
MD5 e0b85a889f4443f4337babc5be7ebca6
SHA1 1f6adb78c442550c4d76c996cac6ef284ef829c9
SHA512 0a4e94809c33d88dd228c5d6d634e833472f115f59006a9543e38deeddb0efbade096b1cb865b03aa2c51ebe049ff230cec74a50e2650a4096dcb2f3f1b1e1ef
SSDEEP 196608:TxtW2vuCuxJ92npGID3SvTYgVRV12Sb0KF2vAfy+UBhg:TW2vJu8pGIzgDZ0G2F+1
TLSH
T1407633D41ADE878AC61BF71ACA9B85C7F02175F08D1CE5DB2BE11088A055FE5722A2CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Targets

- Target
  Umbral Binder.rar
- Size 7.0MB
- SHA256 6c5375dc963a3ad5bbbf635fb0704b8c37276393917a5eb52cd1a3d6952b44ed
- MD5 e0b85a889f4443f4337babc5be7ebca6
- SHA1 1f6adb78c442550c4d76c996cac6ef284ef829c9
- SHA512 0a4e94809c33d88dd228c5d6d634e833472f115f59006a9543e38deeddb0efbade096b1cb865b03aa2c51ebe049ff230cec74a50e2650a4096dcb2f3f1b1e1ef
- SSDEEP 196608:TxtW2vuCuxJ92npGID3SvTYgVRV12Sb0KF2vAfy+UBhg:TW2vJu8pGIzgDZ0G2F+1
- TLSH
  T1407633D41ADE878AC61BF71ACA9B85C7F02175F08D1CE5DB2BE11088A055FE5722A2CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3
- Target
  Umbral Binder/Binder .dll
- Size 27KB
- SHA256 5dd8571132ef404927adf7a1ac7eb26823d89271f62883f1e56c6eeeabc3d466
- MD5 2c98aa00d1633e9afaeaaba6cc87f287
- SHA1 bb449564b72f3687c311648d8e5c02edd5d51d96
- SHA512 2ca0156e2a6236408af944317f79d7b647c869bfcd483ba730cf0b70bf8d962937e845d4fedb215b81efc2edc10df48e633846e1bc57209947a0f78da55d812f
- SSDEEP 384:TVi/qWHkd0DuGfSjVqe2k0Ri+7qyz4etmdXaP4osxlK6Yup/KJVWizCW:TOVyjVT24+7oetmdqP4oNW/KJ1
- TLSH
  T1A0C20926B79C09A1EB6F8D38DAB393458744343DB7218DEF4720511B2BD16D4AA34BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5 behavioral6
- Target
  Umbral Binder/By DRX1 and & 0xSamuri.dll
- Size 684KB
- SHA256 35fce1076f99ccb873cbc9f89399a83a0da70d9b4a0912761c25457717964ce4
- MD5 b94cc2c6e02a2f34b54456221607a830
- SHA1 7216fc590b2791a6f08bbcce853aebba3f5948bc
- SHA512 8e41fc3425de11d6f35c04affa0237f2f859ac4a8dd22a38beca4d555f7791c81ffdc163fbced6eb404a5a9771779b5493b7065915dc238d1d28ae1905cf8663
- SSDEEP 6144:ZSrbYSoNuiLnA9I4V6RXfagM1I4V6RXfagMmUMle6ZjxLV/ypNCapOJZ59QX:ZSrekokonUCe65fypNCapOl9
- TLSH
  T14DE4D52012B80B5FD5775739DCA0A3206A746ED4EA5AC30E85E47CA735363B1F9C06EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8 behavioral9
- Target
  Umbral Binder/Umbral Binder .dll
- Size 154KB
- SHA256 cc7dccbae53dd4ef0521a9ad260b5094d91f2c5a631072687279c03281c1579c
- MD5 ad92544db12e3b50ecbd9b0f8ff1331f
- SHA1 108943fbf8312bbb0c9cac3931c227cd3c60e87c
- SHA512 2a33bca7d7c8f960a27ff0e703d30c0628ace9abcbc1930bc6e4a1d9a6165e0719bfb6238e79df1e3fa2b6fdcbee4477e7d87b1f5bbe8863a202dc7a508305c3
- SSDEEP 3072:yBvYv24Qwk0uHtYN2ZrO3p5oKKASB0ddOQYgOxTsvmbtIahY2r:yBg2VWuo3554ASB0ddOgah
- TLSH
  T114F35A22A3A804ABC9A7D23CD657871BEBB3B40023115BDF0124869D6F57BE17E3D365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12
- Target
  Umbral Binder/Umbral Binder.exe
- Size 15.7MB
- SHA256 83cbc0a621f5d41735e8d2c0c281e40b040362aaf350d63f3c4859ac1247f435
- MD5 a06babe2ff11b3d9898e9eb7b9d8606f
- SHA1 1967a284e28efecb67d514a02b9f7d2f5583fe75
- SHA512 0f236a5a8b2ad20135a5ec47d08340ac425ff644546e9d3817c4d3773c0086dbb76a19600a289c36be6710b4e25d474102d0b7901374c93f51c768f3cb8a00d7
- SSDEEP 98304:VaKU7cIpamen4TycGWM8W7K8AiujWmnjJJSvlbx4R8cQf2s0:2AV4mr8W7xoWudJSvlbS9QeP
- TLSH
  T118F6D910ABD680FEE927E43E1541FE9247E9B7592F4DEB678C44DEEFB122E0E5914020
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext
behavioral13 behavioral14 behavioral15

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Executes dropped EXE

Maps connected drives based on registry

Suspicious use of SetThreadContext

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Maps connected drives based on registry

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15