Umbra

Overview

Umbra (cataloged as Umbra Loader, Trojan:Win32/Umbra, and Backdoor:Win32/Umbra) is an underground modular HTTP botnet loader and malware distribution framework active since 2012. Developed in C++ and commercialized across cybercrime forums, Umbra was specifically architected to provide threat actors with reliable initial access staging and automated secondary payload deployment. The loader incorporates advanced evasion modules, including ring3 user-mode API hooking, anti-virtualization routines that inspect BIOS serial numbers and hypervisor artifacts, and a built-in 'Botkill' engine engineered to discover and eliminate rival malware families residing on the compromised host. Once operational, Umbra establishes HTTP-based command-and-control communications, periodically polling operator servers for encoded tasking. It injects downloaded executable payloads directly into legitimate operating system processes—such as explorer.exe or svchost.exe—utilizing process hollowing to evade endpoint file-integrity scanners, while maintaining persistence via obfuscated Windows Scheduled Tasks and Registry Run keys.

Known aliases

Threat reports may refer to this family under multiple names:

• Umbra Loader
• Trojan:Win32/Umbra
• Backdoor:Win32/Umbra
• Trojan.Win32.Umbra
• Win32/UmbraLoader

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Custom C++ Http Loaders

Known Derivatives & Downstream Variants: Umbra Loader 1.0 · Umbra Botnet V2

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• 7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b
• 8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c

Delivery vectors

• Spearphishing emails with malicious macro attachments
• Exploit kit traffic and compromised web redirects

Persistence mechanisms

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UmbraUpdate
• Windows Scheduled Task executing dropped loader from %AppData%\Roaming

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_UMBRA_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Umbra"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "umbra" ascii wide nocase
        $s2 = "umbra loader" ascii wide nocase
        $s3 = "trojan:win32/umbra" ascii wide nocase
        $s4 = "backdoor:win32/umbra" ascii wide nocase
        $s5 = "trojan.win32.umbra" ascii wide nocase
        $s6 = "win32/umbraloader" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Umbra (Loader) Execution & Triage
id: a7042579-bdb6-5a7d-b802-3d5161734d3b
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Umbra malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/umbra
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.loader
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1105
- attack.t1547_001
- attack.t1053_005
- attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_UMBRA_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Umbra tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "umbra" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately disconnect the endpoint from network interfaces to disrupt active HTTP polling and tasking execution.
2. Collect a memory dump to extract injected payload DLLs and identify decrypted C2 server URLs.
3. Inspect the Windows Task Scheduler and Registry Run entries for newly created, obfuscated autostart configurations.
4. Reimage the affected workstation to ensure complete removal of injected hollowed processes and dropped secondary threats.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on simple file deletion, as injected memory threads will quickly regenerate dropped binary components.
2. Avoid leaving compromised machines connected during analysis, as operators can issue remote self-destruct or wipe commands.

References & External Analysis

• Microsoft Defender Threat Encyclopedia - Trojan:Win32/Umbra
• ZeroSecurity Threat Research - Umbra Loader Overview
• Search "umbra" on VirusTotal (External Analysis)
• Search "umbra" on Any.Run (Sandbox Sandbox)
• Search "umbra" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Loader)

Explore other documented threats in the same operational category:

• Nisloder
• Bumblebee
• Gamarue
• Emotet
• Darkgate
• Smokeloader
• Pikabot
• Bazarloader

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/umbra.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.