Extracted

• • Target

    S500RAT.exe

  • Size

    12.4MB

  • MD5

    eca30bacd3085f447705c090cf780563

  • SHA1

    86d0d579742aeae2bea804b065abfa9ebf02b952

  • SHA256

    a5e929a6859512632ededb0d04f9b706fcc8568f828047fae99f2767f4f6c783

  • SHA512

    9c6ca62412486459c36818756aeb694caa9c6520e3178534ce1e0c2017df78e8fe359ef9f2ee8faaa8791ebd1fea99edcb4c15315b7294e0366ab4f00d3107b3

  • SSDEEP

    196608:PQb6doh5jCqj6dehxHTOf+Ce2XkuujHWRcQRO7F0p/GChj171pZqeYAtmk3BC:kionuqjtxVRA+BQQGprjbvqeYZwBC

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2