Extracted

• • Target
    420-services.exe
  • Size 1.7MB
  • SHA256 0bb458dbc030669e76188d25fa7421c2dd688497602066db440f6463405d4637
  • MD5 bebff2e673b501312be1a507ad0068a3
  • SHA1 3c9e98d504fb87e53b3ac981af8566c6dc309b8b
  • SHA512 adb630f5e2bb1e04c22ca782bb351fc5276f5b525cc2ad73729080fecc843ce6825cb93df7378b41feb0bb8e3291803020f9a5ca5f715482ceca2323f31052d3
  • SSDEEP 49152:IFiFV/kgMcXeYZxOUw/tdJJAUQ7vJQVRSKh0ANE:2i3icPxOx/7AFhu7hw
  • TLSH
    T1BC85337592D47C34F37709FB0897A61FEAB58A51482A3C2773489D63AEF1F0E05906E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryumbralstealerdefense_evasionexecutionspyware

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    Umbral.exe
  • Size 229KB
  • SHA256 343e97e593d51b3c2f613ff85216adb9737812394509367db9d6ae9cd1f094aa
  • MD5 6ae3ee0557ead69970f7b53eafd0a302
  • SHA1 f8f49722ae4c054977dfe6d5cf7ab25dc0dd0ac7
  • SHA512 4927f56bf90b06dbb7861475a9762e936a0b8355b3f487c9c92e7c89a1a2cc7babed1fd038e6a131309cd96d06cfdc2f51550b7582f49d1a23b91cd02d46c305
  • SSDEEP 6144:tloZM3fsXtioRkts/cnnK6cMloVT7BPUonCWvRsY99Yb8e1mRi:voZ1tlRk83MloVT7BPUonCWvRsY9if
  • TLSH
    T1C8346B4933B88F17E25F8BBDD5B0549F87B1F143E90AF78E0C8899E82411B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryumbralstealerdefense_evasionexecutionspyware

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral3behavioral4
• • Target
    sv_host.exe
  • Size 3.3MB
  • SHA256 a0cdbf6faf2b717282236f365cf54179156ad82225dca378c5c607526bebcebf
  • MD5 d74da345b2cb8646d56d100df057aa3e
  • SHA1 63eb9b64692961307168b9441de676d4cfd50cdc
  • SHA512 43cbccae47f06b2a99caddee3aff019d097da7fc1eccdb77d19ecdafb9c5ff07581e2ca76d0eed91b6f8f7459bf5ddc367293403a8e6758fa3e6a523d2b5cce6
  • SSDEEP 49152:515MrQiRdMVja689ErPMdE0M3jmpHmplZKDZK72d7WpKkqfod9K3rx0d5hPU:5DCdMM6UEp0MzmNmfEDE72dkK+9q
  • TLSH
    T130F5D042635506E5C82AC1BCD64BA717F374384947204BDBEFE48E527F976E02A3A387
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6