umbral | c72d63f457ec53b1bd7fb9a56290808dd8d16c1808c74260000883ab7a581f3e

General

Target
Loader.rar
Size 1.1MB
Sample260819-ym3pcsvthv
SHA256 c72d63f457ec53b1bd7fb9a56290808dd8d16c1808c74260000883ab7a581f3e
MD5 c98c22aafcc7e395e9d80be9ad85cd9e
SHA1 266bce7a71d3e85631ba6061a1cd59fb232453ea
SHA512 ddb9d09857483fa3e8b2ba20e7df49e111ce09c10d36592a55217d46e11b215a3f4a3c216ffdf1ea10224b1e1161f0627df54acd6e305da6b97ae7eac3bca879
SSDEEP 24576:qcpXBeXTACytGvT/UkydToy9O/sJCW4SJeK6dG7t9zPLL+nqBJ511lzG3j:FBeDA9uydTowGsJCWnMK6uJBJM
TLSH
T18335337FCF15B53BF1C456F5B46BE4826894A62A86293F2B4DB2BBD0C5300E41A44F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Loader.exe
- Size 1.1MB
- SHA256 5ddd88a2e01fd173974d45eea41d6835ea1e0e6f89ff3165f2b49b256963961c
- MD5 c525491a369b3d926183c5ed3533a5d9
- SHA1 365a5301bab12a7512d636a415c3fca3cf568e3d
- SHA512 5e73fbf150cd593a64fb3656dfab157bbafefe3aaa1cae71cf6b5f4b6ebd3c585ff184c82165936256134d06b220c6f22b91e83caf8d2eb3cfa0f2f420620439
- SSDEEP 24576:NpbdQQqZl8nmoiCqOKGnTpPs9xYo3wxoVrHUgZ:rR5qZ6m0nTpPsPy+jr
- TLSH
  T1583512CCB52472EED957C032CAD85C68AA50BC77831B5607A8AB106DAD4DCC7DF291F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution umbral persistence spyware stealer
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Umbral payload
- Family: Umbral
  Umbral stealer is an open-source modular stealer written in C#.
  stealer umbral
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2