Extracted

• • Target

    ConsoleApplication1.obf.exe

  • Size

    424KB

  • MD5

    9764ad0ba2c14105efa6cb7462beda58

  • SHA1

    40c717e44479d0460a2b1789dbaf61a648b038a9

  • SHA256

    52770ec8f2e84b3e264870a7533286670e61bff2c8932f0cd6cc1f60af3323ae

  • SHA512

    d5a5313f377d17a21ec485b6e8ef6ccc02864b4cda1e8c4d47c790a60e3f0430a8fdf482fcfe116b52fb063f298abd594ff9167c68ffda23f0c69fb84d299309

  • SSDEEP

    6144:hY2cJFqVZloZM9rIkd8g+EtXHkv/iD4ZZACl98e1mbiB8BOaedF6IxI:OpJFqVroZOL+EP8h7nuMawF6

  Score

  10^/10

  umbralspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1