General
- Target MasonService.pif
- Size 2.6MB
- Sample260718-14f8ssd17l
- SHA256 9f7bf14ba4ebd047fe0382abd5d411575f137327faf6aa022f4fa3128291537a
Score
10/10
Malware Config
Targets
-
- Target MasonService.pif
- Size 2.6MB
- SHA256 9f7bf14ba4ebd047fe0382abd5d411575f137327faf6aa022f4fa3128291537a
Score10/10-
Detects DonutLoader
-
Detects Umbral payload
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory