Extracted

• • Target
    EAX Advanced HD/EAX Advanced HD.exe
  • Size 2.2MB
  • SHA256 925c8fa085c56e92bf3762409cbddf9750bea788a8dfb88edd3725a9e39add64
  • MD5 491a15080289497abb1b12893e310e86
  • SHA1 85e77dabbfe2103aaf45efc370ff02d5d09e76da
  • SHA512 7464b669d81676aaad199a97895b96bc5457c2b63bed3a4d54c52b1a723cbdf684786b25b73ac46c6f533fadbc15b5e4d7177ae77c8baab7cd81b0ae4fe7b324
  • SSDEEP 49152:2uASjAXALPTnTYlr1YFflCQmNzg0hrB2sQSUblhxPYfEHIwo7S:2jSjyALP71FflC7ZTfdev+0f
  • TLSH
    T172B58DA90F1148E6CC26FD343A8A04156DF4BFFDB8EDB7AAC9D5F0919411074FA929C8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1
• • Target
    EAX Advanced HD/Guna.UI2.dll
  • Size 2.1MB
  • SHA256 6d876b257a97995d21072acd44580633468516121145cc218277edc18f971030
  • MD5 58459aefb74d5ff786b9efb982d44eab
  • SHA1 584f851c9824a27f4e2e5594ac206f8b165adf72
  • SHA512 80e975d2726eb1e4515a79f3ced422e61315f9b2bcb87d054aa654c1885c12c2a16f75da9aba6f8cd2dd652bb85da50579d1e618f10fab1e50c0cd29f37c7b55
  • SSDEEP 24576:mecRcAIrcai1e9RcNiCljNAXCITob+HgbY8DkUKAMDitqTwCTxZmxV7FdHQ/jzwQ:3AIKyo+HgbY8DkRmaZ8V7FyH
  • TLSH
    T133A50A147ED4EB27D16BCE33D5E24011E3F1E5A32AB1EB0E76D35768184234A788636E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral2
• • Target
    EAX Advanced HD/Melanchall.DryWetMidi.dll
  • Size 778KB
  • SHA256 ad4ac36ecd26a0dd9c79ed0fadd6a9a18fcbdef0032af22f083e9430e1c84e87
  • MD5 ed0dc7a819ba3e72503409b1bc3f7b66
  • SHA1 9e2ead3d137005dd19573f2695657eff3015bbf0
  • SHA512 b4709a51d7da713f1ae0828664f9dd622ad6f8740d0d0c9872f3ab54a9bd61d01fb7c9bdd1b24f012880f16e86034f2d0926c02c73276ddb1ac55ea5643db9f0
  • SSDEEP 12288:vwUNlhmD+rq4sdOuxyuD63PdQAdPYfFRvBR:vwUM+GC1uWPdG3BR
  • TLSH
    T19B05591237EC8E3BC6AF163BD570129963F0E846B393EB4B2314A6995D96B425C403F7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3
• • Target
    EAX Advanced HD/Melanchall_DryWetMidi_Native32.dll
  • Size 56KB
  • SHA256 080346c638e219ec7cd4748e370e5e11931ed3a228c17f76d84c4d10ba9c9e6f
  • MD5 1b976d18b403ffb7d670b17a871bbfd4
  • SHA1 7e2022b1833f8ad6c4f4cc643d7068e013107ebd
  • SHA512 1b676ca71cba6ed2fc9952e46038eb891217a7960d7aa10b37dcb0f6230e30ab2e62d1e36faf7c783785c7874173dd29ab947e8bcd4be8c36cec7277a2340692
  • SSDEEP 384:ikfQAw+aLuu4N5ljtm8Xy9kjwJFP9TNaZFjnUmWw6w+e5XchXSvWZdTc2xv1Awo6:hft9RBi9kcfPmZFjHP5cJPDHthH
  • TLSH
    T18343A890BE844C9AE411B37854E5C167B63CB9D5C6031F0766286F35AB23BC13EDA27E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral4
• • Target
    EAX Advanced HD/Melanchall_DryWetMidi_Native64.dll
  • Size 65KB
  • SHA256 80ca89af931e43642a125ec82e253d9bd7002088d000daba6e0661cdad89f5aa
  • MD5 5326dfc6840947388f19f474c28e8c55
  • SHA1 81afe328f00c500a7138c16c2a0ef200e2a122e4
  • SHA512 4c0a1385438f26c1633c58c5e57f0f94ce704d8da52ec16f6111d2347e69cf8c0a3bdf9a4e737794110c02108ed70a4b65dec0ef67fca16d9103647e65a7ac5c
  • SSDEEP 768:STukqEi0unSZFjZe7+zZj2WuLGIC1FyOJJnD19UkG3JSTEUb:G3dun+jZeyYaIC1drGoTEUb
  • TLSH
    T1636350E12FD44C9BE925A23C52E6C232353CB9E447534B07963469321F13EC17EE9A9A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5
• • Target
    EAX Advanced HD/Melanchall_DryWetMidi_Native64.dylib
  • Size 88KB
  • SHA256 aa08c542e77b045fa1e00d4feab21080ceb415c4b6c343b0dbc5704d1fb02f92
  • MD5 a51c6118f789a4f373ab25d98fab2988
  • SHA1 80eafcd0d5806bb6bc40600d418206b78f4240a4
  • SHA512 333a70512c919ec4119e9ce30364ad5380655f9105c60fdde4a29de600d54985bee73b02f498cd9a90d0ded58d9ea4d9eb1ba76f1879b595760d6b5174b2f647
  • SSDEEP 384:OwUiZX3J6yvvnVDytNa2ZHS60LuoM5W/pFA6Uxf9pVtjN/gDtgd/OC5zgtDH23Zh:Owd3CBUuL5WafVQ99W3PQdLj0
  • TLSH
    T14E93F9E36BC8561CC58B62B4C85101E2F435F81613E6461EF3DCAFA5EC197C82646EAE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral6
• • Target
    EAX Advanced HD/VoicemeeterRemote.dll
  • Size 156KB
  • SHA256 5d85a8e00c714a707a65671936fb49611f4e7751a9065c618804ed5ca47872cb
  • MD5 79b4ef6b17d0a8bb825437773c1d8e3f
  • SHA1 255fbeb8ad45faad93afeac2afa2cb7e7d78d079
  • SHA512 0c76b45b3c311f34de0087755d63e7966edf24ad77360897475854ff66421ce55e93f35a78ea10f15cce8ccc505618d12dd6114eabc89b73a1e468f5b16799f9
  • SSDEEP 3072:+cvA+X1yaikOLqMvbJl1rvVygoP5UG7GjSVX:PYH1rtyrQjS5
  • TLSH
    T1E6F3AF1376D240F6D5813EBD14E7373BEF3AAA5648668E438B98DD521C31352BB2620F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7
• • Target
    EAX Advanced HD/VoicemeeterRemote64.dll
  • Size 188KB
  • SHA256 6c108f99c955ec963702dba37739d70c31c9ce4d77758b312c0233a1f435f4fb
  • MD5 b16e2603eeee1099dfe97ecf987a1319
  • SHA1 a4229d70f8471d2bf7df79c5d7b426aa0bb60b94
  • SHA512 3c27ae44a7d9bd88c169721a963924901abecf30537582e44f9610054e19bb8cb6bed18fadf40d71391af84d327227ba9dac2785650dd4b664eef18659fee839
  • SSDEEP 3072:aR8mc+AKYjdhTzhTq4UeT/AS5IGFM4W1CgmgReNA9KHVL:aRVXA/zhTWeT/AS5L6tTKAEHx
  • TLSH
    T190149D8A329010FAE85B9238C9E76656FB73B45313755BCF166483761F173E22A3B321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8