Extracted

• • Target

    Windows_Office Activator By RXS.bin

  • Size

    779KB

  • MD5

    7fc8b5c1779a9aeeecfcb4241e263d00

  • SHA1

    e106ecab86ae0aa5fd94bffe49279fe793bb5e2c

  • SHA256

    a8f2fe0ab643b948071bdb619fd4579740336e5744bfd4f2aed4c674f7c75f4f

  • SHA512

    b99b746339cff5142d504bdeb4551d305034f8463f991100f200f83e10805a79c573a611a4a24558c4c41eab7460f5dafecd40c69fdc32d4c0faefd86285c947

  • SSDEEP

    24576:FBuDErbOl69QjPPN15Nxtug2GNqfpcgHN:zuUE6aVNxtlaRc0N

  Score

  10^/10

  umbralstealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2