Once the dropped program starts, it decrypts its settings with AES-256-GCM. The config blob begins with the sentinel UMRBLCFG. In this build there is one Discord webhook. The second webhook and the remote kill URL are empty. Collection runs as a set of jobs across 2 to 8 threads. We can observe 31 Chromium-style browsers and 18 Firefox-style browsers, covering passwords, cookies, history, and site storage (Local Storage, Session Storage, IndexedDB). The same run also goes after Discord tokens, Telegram, wallets, Outlook, Tox, SSH keys, and a couple of game paths. Alongside the files, it reads clipboard text, takes a webcam frame through DirectShow, captures screenshots, pulls Wi-Fi profiles with netsh wlan show profile … key=clear, and writes a full-memory dump of lsass.exe to LSASS\lsass.dmp. If it never obtained admin, it copies itself into the user Startup folder as an .exe, into Common Startup as a .scr, and creates a .lnk. There is no Run key in this path. A separate switch rewrites the hosts file. The collected data is zipped and posted to the webhook as pnmsplit_ attachments, with a small JSON embed. The C++ type on that send path is penumbra::postman. The VM-exit and debugger-exit switches are present, and in this configuration they are off.

7/10 RAT command strings. PCShutdown: shutdown.exe /f /s /t 0 PCRestart: shutdown.exe /f /r /t 0 PCLogoff: shutdown.exe -L Hosts: edit \drivers\etc\hosts (success text "Modified successfully!") StartDDos / StopDDos RunShell plugin / sendPlugin / savePlugin / RemovePlugins ("Plugins Removed!") uninstall / update / CLOSE Urlopen / Urlhide PING! / pong Network template: POST / HTTP/1.1, form-urlencoded, Host taken from the decrypted host, Content-Length fixed at 5235. User-Agents on hand are Firefox 66, Chrome 60, and iPhone OS 11.4.1 Safari.

4/10 binance.exe is the Go stage. If it is not an administrator it relaunches itself with ShellExecuteW verb runas and returns. The elevated copy continues. Once it is admin: - Mutex Global\. A second copy exits. - Admin check is the Administrators group (S-1-5-32-544), with a fallback open of \\.\PHYSICALDRIVE0. - Defender: path exclusion, process exclusion, and realtime monitoring disabled. - Persistence for this stage only: HKCU Run value "Windows Update" set to its own path. - Writes svchost.exe in the same directory and starts it hidden. It does not wait. A stage log, fud_stage.log, is written only when FUD_DEBUG=1.