Extracted

• • Target

    cheat.exe

  • Size

    231KB

  • MD5

    8e15d02166ecc355757bd303fe50bc1e

  • SHA1

    e527a5f5aea7c84c762cb42b74a420f79ffc20a3

  • SHA256

    112eb0863c7d7123d10b7e78262df292b43ab2cc11c81c92e41f64df4d47edae

  • SHA512

    63d150761e25a4f6549ac72533be705c1a01643527bf1f4f31fa7dec8b5c49369fe90d64f2fa4fa00e002ad13f6ef45596f0fdc3774058fd994ae1327a71624e

  • SSDEEP

    6144:RloZM+rIkd8g+EtXHkv/iD4bQmmn9GuBi0dP6aPiXb8e1mvDki:joZtL+EP8bQmmn9GuBi0dP6aPkKN

  Score

  10^/10

  umbralstealerexecutionspyware

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2