Extracted

• • Target

    MM2farm.exe

  • Size

    231KB

  • MD5

    512f439206e868cc2c2548b88c5d0b8c

  • SHA1

    9460a24c9d5c9e4629f508f5b0711dc12719e43d

  • SHA256

    7f3c593c069e2b61afce1a1d7dc5c4f4ed355d361223e6a7c24c6bf2c95b7962

  • SHA512

    14f0c46cae699850d44ad973b9ffc8de39ea25e76153ff607df9ed1aae13cde115374c6b0a46b922859f7ac439dafe7ef285445c1291b789d5ad75c450b84f9b

  • SSDEEP

    6144:xloZM+rIkd8g+EtXHkv/iD4C2+qlx8e1m5Vi:DoZtL+EP8P73

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2