Extracted

Extracted

• • Target
    237d1e085955059b137a21e21a5a3e8a8be0813ab6f737539b25b99588667d74.bin
  • Size 1.6MB
  • SHA256 237d1e085955059b137a21e21a5a3e8a8be0813ab6f737539b25b99588667d74
  • MD5 9b99e6c34a98c3877154c65bb111228b
  • SHA1 e38b1c672e300178f465a130c8d6774b7540276c
  • SHA512 6880f563f728abc5d0301f2fbf16a210ca57523ac79cca8e8e9ffa2fede139063a425e07853d897d775770cf4ef425c783c70e534692e036520ed1cbe93ffa7f
  • SSDEEP 24576:37dZ/oX/9m/diY2HGOmZ+xMdSmc7W1SbBXZPLhn1Ve/S5yB1jX9SveTr6bJb2CnP:3Bc9aeNmcx/K1StD1A65q1BlryPvFR
  • TLSH
    T1D085D08950DCE9A2CCCE65B5183981B9C10269E8D73FEE7629F72E4BB3513D044172AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralxwormratspywarestealertrojan

  • Detect Xworm Payload

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2