Extracted

• • Target

    ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf

  • Size

    6.5MB

  • MD5

    332ba662e3c3f073ae86fee29789571d

  • SHA1

    5901a5ef0817d5e56f54b4d2a4385717a1b21975

  • SHA256

    ae1d6b818db2e9097ca27a9ebdc79ac9f1ac6904305416cc20b0dd532c1fe4bf

  • SHA512

    8a00f9595aa18ec77b268a4b3d37888ddb45fd567a09597f5bd369f767f7a5003784606ecc92943a1f8b02d2ae9afa8cc9b99e40d8f03f9aaef2c511cac4845b

  • SSDEEP

    196608:o4hV+n8bqD6SiCwDYHLiOYf6OQlmfVuwcP/OCw3P:o4Xc8bqD6SDkhamfVuwcP/jQ

  Score

  10^/10

  umbralpyinstallerstealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Detects executables attemping to enumerate video devices using WMI

  • Detects executables containing possible sandbox analysis VM names

  • Detects executables containing possible sandbox analysis VM usernames

  • Detects executables containing possible sandbox system UUIDs

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2