MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


UmbralStealer


Vendor detections: 14


Intelligence 14 IOCs YARA 21 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
SHA3-384 hash: e8fd8e0f8e7862250d9f0fd9facf49f2da01cca1ee0a7af69165788ee0fe921534abcad1d065d6c103aaf1d498d5d73e
SHA1 hash: 3100c1c0c5f98b1a7bccef0cdcfde6b34e38992b
MD5 hash: 9e511d399fbc2bf0c2d45302dc62be61
humanhash: river-quiet-robin-equal
File name:immortal.bin
Download: download sample
Signature UmbralStealer
Create hunting rule
File size:1'112'064 bytes
First seen:2024-04-27 22:13:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2e5467cba76f44a088d39f78c5e807b6 (131 x DCRat, 112 x njrat, 80 x RedLineStealer)
ssdeep 24576:fO29aTBMPYvJnXAvKhO7CMbNdCrty7ARVJ3g6cbhbZxvI:G29adQt3CrtWQcb3xv
Threatray 384 similar samples on MalwareBazaar
TLSH T1C83533018CE486F5F41E8AF760FA1552E335D5B11989A87E3AA6061CB0237FDED2EF11
TrID 25.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
19.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.1% (.EXE) Win32 Executable (generic) (4504/4/1)
7.8% (.EXE) Win16/32 Executable Delphi generic (2072/23)
7.8% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter Reedus0
Tags:exe spyware

Intelligence

File Origin
# of uploads :
1
# of downloads :
500
Origin country :
RU RU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8.exe
Verdict:
Malicious activity
Analysis date:
2024-04-27 22:14:22 UTC
Tags:
evasion umbralstealer stealer discord exfiltration
Link:
https://app.any.run/tasks/51231c7c-7308-41e7-a988-d80989d09049

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a process with a hidden window
Creating a file
Searching for the window
Launching a process
Sending an HTTP GET request
Enabling the 'hidden' option for files in the %temp% directory
Creating a window
Unauthorized injection to a recently created process
Adding an exclusion to Microsoft Defender
Changing the hosts file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin masquerade obfuscated packed shell32
Link:
https://www.filescan.io/uploads/662d78ab3137a4e0f3c19cc8/reports/5aad32b0-8a7d-4eb4-b1bc-229a2f0bf300/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/0f937a03-6ad8-442e-889c-baaa440a0a84
Result
Threat name:
Blank Grabber, Umbral Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1432695
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Check if machine is in data center or colocation facility
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has nameless sections
Yara detected Blank Grabber
Yara detected Umbral Stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1432695 Sample: immortal.bin.exe Startdate: 28/04/2024 Architecture: WINDOWS Score: 100 38 raw.githubusercontent.com 2->38 40 ip-api.com 2->40 42 github.com 2->42 62 Found malware configuration 2->62 64 Malicious sample detected (through community Yara rule) 2->64 66 Antivirus / Scanner detection for submitted sample 2->66 68 7 other signatures 2->68 9 immortal.bin.exe 15 6 2->9         started        14 chrome.exe 1 2->14         started        signatures3 process4 dnsIp5 44 github.com 140.82.112.3, 443, 49699 GITHUBUS United States 9->44 46 raw.githubusercontent.com 185.199.111.133, 443, 49700 FASTLYUS Netherlands 9->46 28 C:\Users\user\AppData\...\kmk00mnr.qd4.exe, PE32 9->28 dropped 70 Detected unpacking (changes PE section rights) 9->70 72 Detected unpacking (overwrites its own PE header) 9->72 74 Hides threads from debuggers 9->74 16 kmk00mnr.qd4.exe 14 3 9->16         started        20 conhost.exe 9->20         started        48 192.168.2.5 unknown unknown 14->48 50 192.168.2.6, 443, 49698, 49699 unknown unknown 14->50 52 239.255.255.250 unknown Reserved 14->52 22 chrome.exe 14->22         started        file6 signatures7 process8 dnsIp9 30 ip-api.com 208.95.112.1, 49702, 80 TUT-ASUS United States 16->30 54 Antivirus detection for dropped file 16->54 56 Multi AV Scanner detection for dropped file 16->56 58 Machine Learning detection for dropped file 16->58 60 Found many strings related to Crypto-Wallets (likely being stolen) 16->60 24 WMIC.exe 1 16->24         started        32 142.250.31.139, 443, 49742 GOOGLEUS United States 22->32 34 play.google.com 142.251.111.138, 443, 49740, 49741 GOOGLEUS United States 22->34 36 5 other IPs or domains 22->36 signatures10 process11 process12 26 conhost.exe 24->26         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8/
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2024-04-27 22:14:06 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2hrpht6fhkpfdy4ka4ybducygmcmqmdczqgtwfnkz7wgj24osua._file
Verdict:
malicious
Similar samples:
09570f445a9a80479957a36ea2e038800d5a01acf338793274f936c108f21f24
UmbralStealer
31fb4e3de00fdb16562c1b03088df5245e45a49fb3646c90f1e5df0e9bc0acd0
UmbralStealer
361b53f4b3e887b963bd607d994f9f42344b39e871b1142c8e56ff7182e4c96c
UmbralStealer
68ce0b654df185f888ce7bc64305873778b4090e38abe5b933ff6cc864194753
UmbralStealer
83a4a3957a752185873961a6c761e7b8f2883379978dc2940c03278d1341e086
UmbralStealer
90568713c6015b5284f369bf077d6fbaf0495c47f0f27a4f8b9df89c05fd8f6f
UmbralStealer
+ 374 additional samples on MalwareBazaar
Result
Malware family:
umbral
Create hunting rule
Score:
  10/10
Tags:
family:umbral stealer
Link:
https://tria.ge/reports/240427-15m3qshf69/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Downloads MZ/PE file
Detect Umbral payload
Umbral
Unpacked files
SH256 hash:
ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8
MD5 hash:
9e511d399fbc2bf0c2d45302dc62be61
SHA1 hash:
3100c1c0c5f98b1a7bccef0cdcfde6b34e38992b
Detections:
SUSP_XORed_URL_In_EXE
Create hunting rule
Link:
https://www.unpac.me/results/3660209e-f032-48e8-ac33-5bb25b5d4dfd/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ce8f179e7e29/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EnigmaProtector11X13XSukhovVladimirSergeNMarkin
Create hunting rule
Author:malware-lu
Rule name:EnigmaStub
Create hunting rule
Author:@bartblaze
Description:Identifies Enigma packer stub.
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:win_smominru_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.smominru.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

UmbralStealer

Executable exe ce8f179e7e29d4f28f1c5039808e82c198264183166069d8ad567f63275c74a8

(this sample)

UmbralStealer

Executable exe 5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f

  
Dropping
SHA256 5658f42d6332d99827d772a710d74e905f822d23e958c86f802973c2cffe850f
  
Delivery method
Distributed via web download
  
Dropping
MD5 7f32dcbb00de079c31ff7895ae9c0560

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (NX_COMPAT)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteA
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryA
WIN_BASE_IO_APICan Create Filesversion.dll::GetFileVersionInfoA

Comments