Extracted

• • Target

    Cheat_by_DioZ.exe

  • Size

    15.3MB

  • MD5

    7e8d421582aacc3651a5f8ae391e4605

  • SHA1

    0cff4ece5e75a5dc0c5e6076ad782ecf42ad7c16

  • SHA256

    a85235b38f90be244eb57d131951ff69a562714221d640ab9da0480af4aed06c

  • SHA512

    7eb24ed0bddb9a681c231c92c50b52015b09466262dbdf1c1e47219f4fe76cff9adf65860d2c03cf61e8d4e7aa7ee46a7a81464773c56a81fee4a2ebec8192f1

  • SSDEEP

    196608:0KMurhe046YIw782LRg5lA7B+juGhgdKDW/vDhoOocQ4cfVqwc7Mzg:0hurhf4Qm8MR8gwRh+n/lvoPDc70

  Score

  10^/10

  umbralevasionstealer

  • Detect Umbral payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Drops file in Drivers directory

  • Stops running service(s)

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2