@JM_speakss @dotkrueger

This one seems interesting. Going to do some poking to learn <3

yes, but people make it unbearable.

also fair warning, infosec is full of more drama than the Hallmark Channel. best of luck 😂

you’re welcome! also, good morning!

doesn’t mean it’s any less severe. just adding that caveat

having been in infosec for over a decade now….it’s both. Anything “real” won’t be announced online until after investigations or post-incident review. of course, there will be public statements, groups claiming hacks, etc. However, this is far from new.

- File names, together: `dbgcore.dll`, `Settings.txt`, `Bewerbung_Christina_Gruber_Version_2.0.299956l.exe` - DLL export module name `sign.dll` - DLL source name `trotzki_is_better_then.c` - Run value `Chromium_Updater_Updater_Version_1918` - Run command containing `Downloads\Bewerbung_Christina_Gruber_Version_2.0.299956l.exe` - Console strings `Autostart-Eintrag gesetzt:` and `Fehler beim Kopieren` - Stage-2 string `wwanmm.dll` - Stage-2 shellcode `6e6b5be0c01ab42df81965294e1bbbb0cced48e79e55c3369bfc60ef7414f456` - Decrypted `srv.dll` `b6582feeacef5ca504aa19ea689dafb54c05ed243975fa2dec6b98db81caa3e5` - C2 `refugee-help[.]com:443`, URIs `/dpixel` and `/contact.php` - Beacon watermark `987654321` #cobaltstrike #infosec

On load, the DLL checks for a small or single-CPU machine, a narrow desktop, accelerated sleep, and hostnames used by public sandboxes. If those checks pass, it decodes Settings.txt with a word list built into the DLL and injects the result into a newly started, suspended Microsoft Edge process. The injection uses indirect system calls rather than the normal Windows API stubs. It then copies all three files into the current user's Downloads folder, hides the renamed SumatraPDF, and adds an HKCU Run value named Chromium_Updater_Updater_Version_1918 that starts that PDF reader. That logon entry reopens the decoy. It does not load dbgcore.dll again. The injected payload is a reflective loader wrapped around a DLL named srv.dll. The loader's call into that DLL starts a beacon loop: pick a host, check in, run whatever tasks come back, then sleep.

This is a nasty little bugger. Targeting is a German-speaking user, via a job-application filename, with follow-on traffic dressed as a refugee-aid or foundation contact form.

@grok what dats has Anthropic generally released models publicly?

The webhook URL and the mutex are decrypted at runtime. They are not stored as plaintext in the file. The mutex in this build is the old MSDN example GUID, Local\{3F2504E0-4F89-11D3-9A0C-0305E82C3301}. The webhook id is 1561545297325465600. For a retrohunt, the strings that are actually present are PENUMBRA_AV_DONE, PENUMBRA_ANTIVM_HOSTING, PENUMBRA_KEYFILE, pnmsplit_, postman@penumbra, and UMRBLCFG followed by the bytes DE AD BE EF 01 02 03 04. netsh wlan show profiles and discord[.]com will not carry a content search. Those values are assembled one byte at a time, or they exist only after decryption. json_abi_v3_11_3 and expand 32-byte k are in the file, and they also appear in a lot of unrelated software. Pen%08x.exe and PenK%08x.k are UTF-16 and belong to the loader. The other PENUMBRA_* names live in the payload, which is embedded in the loader, so a single rule still matches both stages.

Once the dropped program starts, it decrypts its settings with AES-256-GCM. The config blob begins with the sentinel UMRBLCFG. In this build there is one Discord webhook. The second webhook and the remote kill URL are empty. Collection runs as a set of jobs across 2 to 8 threads. We can observe 31 Chromium-style browsers and 18 Firefox-style browsers, covering passwords, cookies, history, and site storage (Local Storage, Session Storage, IndexedDB). The same run also goes after Discord tokens, Telegram, wallets, Outlook, Tox, SSH keys, and a couple of game paths. Alongside the files, it reads clipboard text, takes a webcam frame through DirectShow, captures screenshots, pulls Wi-Fi profiles with netsh wlan show profile … key=clear, and writes a full-memory dump of lsass.exe to LSASS\lsass.dmp. If it never obtained admin, it copies itself into the user Startup folder as an .exe, into Common Startup as a .scr, and creates a .lnk. There is no Run key in this path. A separate switch rewrites the hosts file. The collected data is zipped and posted to the webhook as pnmsplit_ attachments, with a small JSON embed. The C++ type on that send path is penumbra::postman. The VM-exit and debugger-exit switches are present, and in this configuration they are off.

I wanted to see what was actually in the file. It is two native 64-bit programs: a loader, and a stealer carried inside it. This is C++, not the .NET “Umbral” stealers that overlap the name. Minus a few points to the branding, the code does not care. The program you launch is pretending to be wuauclt.exe. Windows Update Client, Microsoft Corporation. If it is not already running as admin, it asks Windows to relaunch it with runas, waits a moment, and that first copy exits. From the elevated copy we can observe two files written under temp: Pen%08x.exe and a 44-byte key file, PenK%08x.k. The eight hex digits are GetTickCount64() XOR the process id, so the names change on every run. It then starts the dropped executable with no arguments. There is a virtual-machine check against BIOS strings (vmware, virtualbox, qemu, hyper-v, and a few others). A match only skips the louder antivirus step. The stealer is still written to disk and started. Loader SHA256 0152333b311d60a24c104d81635410ee5c371341cc9baac53aaa708331ae589c. Payload SHA256 a37830a3b557497e96b58d5a2ecd7d3928cc4515e772137222027efc6a6586b5.

door knockers too. i get you have a job, but kindly...

I've gotten nothing but political flyers in my mail every day. both sides. If you're willing to advertise via spamming me, i don't want to vote for you. gfy

Huge thanks to @smica83 for flagging this!