Extracted

• • Target

    resou.exe

  • Size

    212KB

  • MD5

    e10ccc6c29f434e57bf20e4b824864fa

  • SHA1

    9a59699a28c8173706d2cb785cea53f45fb4443c

  • SHA256

    547d284150788e783256dc8ad90f90ab6a5a2ff29211c480b4adab5a1032eebb

  • SHA512

    295e3cb9d3844e3586d42910fc2c50d79e08b9e4b5487c1f8a07205b0c26a199227acec7337cebc72926630cd09e5129368851776985f27d88a624c409fe7a27

  • SSDEEP

    3072:TlP/chtWkOIGSkvDvPnsUSCLZHlitA46fsZ44lllllj0em1Sl8eN7bbXVdtXT5jI:9cyHIG3sUSS6A4Uy8eNHhdR

  Score

  10^/10

  umbralstealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1