Extracted

• • Target

    Havoc-Executor.rar

  • Size

    16.8MB

  • MD5

    f92596f16b2227ca7b19b8fcfc146763

  • SHA1

    673eb42df68aec2de4558120785d4b45a7fcbe0f

  • SHA256

    16ab548b51418dc856d375ca306d50fe04ba25df2fb01fdf31057f6fd72f5348

  • SHA512

    668b9ddbdddccf6876ceb6e4294e0b360534ec5bee12881020e9842ee6e19d1f5554c4ca72a0a2335a71c9ab403891c5076c3f9a8ca5140d699eef5a530bee8e

  • SSDEEP

    393216:msqRW0KzrmKC0eNSo38nS1AcYcr2B5u0hKjAXyjbBsK33w4SXjMj:msqLKOKC0eN5sS1Ac1iojAXZFjMj

  Score

  10^/10

  umbralstealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1