Extracted

• • Target

    Hentai.exe

  • Size

    259KB

  • MD5

    e58228a41eb53fd35fed0c1facdbe3a0

  • SHA1

    27647d6d6926fd370c1158e940a5f101bf88e186

  • SHA256

    2e43e4a91eb9abad534cf69f3275f8cba580e2ebd070b439e49d4019998f9548

  • SHA512

    f13dd0c04045cdff35da4c71998d04854fbde679aecffa3a264a1308edbf5591f9d0d9434480b7909f39d1093344fdf84dfdcaac4d24b22fcee774e434df0645

  • SSDEEP

    6144:+loZM9rIkd8g+EtXHkv/iD4BpsY2U7X8ktoGnnGrqb8e1m+iKwM:ooZOL+EP8BpsY2U7X8ktoGnnGCIKw

  Score

  10^/10

  umbralspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1