Extracted

Extracted

• • Target

    s.exe

  • Size

    87.6MB

  • MD5

    f93ef549ba0f00e0a73ca814059e0103

  • SHA1

    8aafb3809cbdee022ec6d4a735788acc8f3e798f

  • SHA256

    b043adb2fe7b0175cc5a83133de3f91c9fcb18c3899566556167b20ad7525961

  • SHA512

    b0bbf622fd6096bfa7436ae9703a98729812a6988d7c44f89e49729bacd020e715970507d454f720d42e0e1b0c0f0a5b5f3c90026134a5ecf2050825c942e626

  • SSDEEP

    1572864:IOLPYmqSiUpFeBrNGpZ7HWdAB7BWFtvIssO9YaqQnqo2ZbhJEw+Jaa:IodqXUpFe5NOWACIw5tgZFJW8

  Score

  10^/10

  discordratumbralevasionpersistencepyinstallerratrootkitstealerupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Detect Umbral payload

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Enumerates VirtualBox DLL files

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1