Extracted

• • Target

    cheeto.exe

  • Size

    229KB

  • MD5

    72614d4abc76ec3142bdc6d5bda7c38e

  • SHA1

    2b616f0b13d92557a7cd73935b3e7e301e294757

  • SHA256

    e82372deee967ba8a1a74e29a8887ac64e700554153267d09a184986a98efa29

  • SHA512

    56d7a569b012da9f9ab99044ac3ed489e1f11a233122b7271f2396e5a11d8e5ddf4f58b8bfa18ae96cbc55c57213d812622777b6fc8684ea96a4919ba202b7c4

  • SSDEEP

    6144:lloZM+rIkd8g+EtXHkv/iD4f6/Ff1DA0rVSjVg8Z+9vb8e1mZi:noZtL+EP8f6Nf1DA0rVSjVg8Z2f

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1