MalwareUsed by 1 actor

Umbral Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sty1x

“More than 20 Umbral Stealer reports were uploaded to these channels via webhooks between January 7 – 9, 2024, including those that Sty1x sent to Fucos.”

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

MITRE ATT&CK® Techniques ... T1047 Windows Management Instrumentation

T1203Exploitation for Client ExecutionEvidence1

MITRE ATT&CK® Techniques ... T1203 Exploitation for Client Execution

T1204User ExecutionEvidence1

Threat Actors (TAs) use game installers to spread various malware... entice them to download and run malicious game installers.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The file named “wime.exe” is a 32-bit binary packed using the Themida packer. When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

T1036MasqueradingEvidence1

The NSIS installer file “Super-Mario-Bros.exe” has been tampered with and turned into a trojanized version of a Super Mario game installer.

T1055Process InjectionEvidence1

When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

T1497Virtualization/Sandbox EvasionEvidence1

Additionally, it checks if the payload is running on a virtual machine and exits if detected.

Defense Impairment

1 technique

T1685Disable or Modify ToolsEvidence1

The function attempts to hide the payload process to maintain stealth and adds it to Windows Defender exclusions. If tamper protection is not enabled, it tries to disable Windows Defender.

Credential Access

1 technique

T1056Input CaptureEvidence1

These tasks can include: Capturing screenshots

Discovery

4 techniques

T1012Query RegistryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1012 Query Registry

T1082System Information DiscoveryEvidence1

the malware gathers valuable data from the victim’s system, including computer name, username, GPU, CPU, and other relevant details.

T1083File and Directory DiscoveryEvidence1

The Run() function then initiates and awaits multiple tasks to collect various types of data from the target system... Acquiring Roblox cookies and Minecraft session files Collecting files associated with cryptocurrency wallets.

T1497Virtualization/Sandbox EvasionEvidence1

Additionally, it checks if the payload is running on a virtual machine and exits if detected.

Collection

3 techniques

T1056Input CaptureEvidence1

These tasks can include: Capturing screenshots

T1115Clipboard DataEvidence1

MITRE ATT&CK® Techniques ... Collection T1115 Clipboard Data

T1125Video CaptureEvidence1

These tasks can include: ... Capturing webcam images

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Furthermore, the “atom.exe” retrieves a malicious information-stealing executable from the following command and control (C&C) URL: hxxp[:]//shadowlegion[.]duckdns[.]org/wime[.]exe

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

hash.sha1●●●●●●●●●●●●View more in app3 years ago

uri●●●●●●●●●●●●View more in app3 years ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyfirma blogNews

Aug 26, 2025

UNVEILING A PYTHON STEALER - INF0S3C STEALER - CYFIRMA

Publicly available stealer mentioned as a comparison for the analyzed specimen’s design and obfuscation techniques. The report suggests possible common authorship but provides no evidence that Umbral-Stealer was deployed in this execution or used as an additional payload.

checkpoint research blogNews

Aug 16, 2024

Unmasking Styx Stealer: How a Hacker's Slip Led to an Intelligence Treasure Trove - Check Point Research

Open-source information stealer whose stolen-data reports were uploaded through Discord webhooks. Researchers found more than 20 reports in channels accessible to Sty1x and another user, and identified reports Sty1x forwarded to Fucosreal. The evidence suggests Sty1x either operated Umbral Stealer or participated in a group using it; direct operation was not established conclusively.

cyble blog historicNews

Jun 23, 2023

Trojanized Mario Installer Spreads SupremeBot Malware

A Windows-based open-source C# information stealer that exfiltrates data via Discord webhooks. It performs anti-VM checks, may request elevation, attempts to evade or disable Defender, can add itself to startup, blocks antivirus-related websites, and steals browser credentials, cookies, webcam images, Telegram sessions, Discord tokens, Roblox cookies, Minecraft sessions, and cryptocurrency wallet files.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Umbral Stealer

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Sty1x

“More than 20 Umbral Stealer reports were uploaded to these channels via webhooks between January 7 – 9, 2024, including those that Sty1x sent to Fucos.”

via checkpoint research blogresearch.checkpoint.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

MITRE ATT&CK® Techniques ... T1047 Windows Management Instrumentation

T1203Exploitation for Client ExecutionEvidence1

MITRE ATT&CK® Techniques ... T1203 Exploitation for Client Execution

T1204User ExecutionEvidence1

Threat Actors (TAs) use game installers to spread various malware... entice them to download and run malicious game installers.

Privilege Escalation

1 technique

T1055Process InjectionEvidence1

When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The file named “wime.exe” is a 32-bit binary packed using the Themida packer. When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

T1036MasqueradingEvidence1

The NSIS installer file “Super-Mario-Bros.exe” has been tampered with and turned into a trojanized version of a Super Mario game installer.

T1055Process InjectionEvidence1

When executed, the file unpacks itself and loads the Umbral Stealer into the process memory.

T1497Virtualization/Sandbox EvasionEvidence1

Additionally, it checks if the payload is running on a virtual machine and exits if detected.

Defense Impairment

1 technique

T1685Disable or Modify ToolsEvidence1

The function attempts to hide the payload process to maintain stealth and adds it to Windows Defender exclusions. If tamper protection is not enabled, it tries to disable Windows Defender.

Credential Access

1 technique

T1056Input CaptureEvidence1

These tasks can include: Capturing screenshots

Discovery

4 techniques

T1012Query RegistryEvidence1

MITRE ATT&CK® Techniques ... Discovery T1012 Query Registry

T1082System Information DiscoveryEvidence1

the malware gathers valuable data from the victim’s system, including computer name, username, GPU, CPU, and other relevant details.

T1083File and Directory DiscoveryEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Additionally, it checks if the payload is running on a virtual machine and exits if detected.

Collection

3 techniques

T1056Input CaptureEvidence1

These tasks can include: Capturing screenshots

T1115Clipboard DataEvidence1

MITRE ATT&CK® Techniques ... Collection T1115 Clipboard Data

T1125Video CaptureEvidence1

These tasks can include: ... Capturing webcam images

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Furthermore, the “atom.exe” retrieves a malicious information-stealing executable from the following command and control (C&C) URL: hxxp[:]//shadowlegion[.]duckdns[.]org/wime[.]exe

INDICATORS OF COMPROMISE

IOCs tracked for this family

8 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 years ago

hash.sha1●●●●●●●●●●●●View more in app3 years ago

uri●●●●●●●●●●●●View more in app3 years ago

hash.md5●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyfirma blogNews

Aug 26, 2025

UNVEILING A PYTHON STEALER - INF0S3C STEALER - CYFIRMA

checkpoint research blogNews

Aug 16, 2024

Unmasking Styx Stealer: How a Hacker's Slip Led to an Intelligence Treasure Trove - Check Point Research

cyble blog historicNews

Jun 23, 2023

Trojanized Mario Installer Spreads SupremeBot Malware

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching8

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.