Extracted

• • Target

    Amruus promo link generator/Promo link generator.exe

  • Size

    228KB

  • MD5

    4e711e7231a67ebf4278a6ba9e2a1f98

  • SHA1

    9bc200a14d089e0fe869674ee5f4219e86dc3009

  • SHA256

    cfb4919168697ab5bfaa045cbf2c647aa55c1ffc8f5109acf90f2e90af14f40a

  • SHA512

    38ac5f01c19304431f1b862172fd0ed7b67fd8926c94e289a7a9b06a6772b02c7708f9ebeb3263269721d379dede458bd29d16fd6eb81eb500d85b202707ec0f

  • SSDEEP

    6144:BloZMUrIkd8g+EtXHkv/iD409mMN5nsAv9R0STTKg/Yb8e1mIi:zoZrL+EP8gmMN5nsAv9R0STTKBm

  Score

  10^/10

  umbralspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1