Extracted

• • Target

    Umbral3.exe

  • Size

    229KB

  • MD5

    7a902c87a60986f18a6b097712299256

  • SHA1

    2c01906a39faa9d27a41e0d3cd84e92410b9c483

  • SHA256

    e4e4f9045dc3683a2a69b9c7625f2ff46ed241ff64b47660a039dbc9d34cb0d5

  • SHA512

    c8b75b3f0a77d1f84167af3c431e186802ccd5271fc4a361142e0209541de37f5d584d487bf5ea4b4d921e6e3846267fdea9f65cbd71001331bfea08de5425b6

  • SSDEEP

    6144:tloZMCrIkd8g+EtXHkv/iD4DDUgoOJBiLHaIJtM34b8e1mmi:voZRL+EP8DDUgoOJBiLHaIJtMQI

  Score

  10^/10

  umbralspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2