Extracted

• • Target

    y.exe

  • Size

    224KB

  • MD5

    4c335d3e3958413df7b9c81b7ac29100

  • SHA1

    a43f7ae504164fd29a9bb7f88430efeb396ed69f

  • SHA256

    7ba28499d2c1399eba708b00fdc97095f938d5755d148fbe5626ffa68b8e5385

  • SHA512

    28008caa99955df01abf2d9756c204b0b4105659ea1150c32a54044f60b3ac7a1c0631530e6b6e3bdd377ecaa6aac4c7845691262d18979cc1f74709a13bfce2

  • SSDEEP

    6144:floZM+rIkd8g+EtXHkv/iD4SQzYkK8eucHi:doZtL+EP8RR

  Score

  10^/10

  umbralstealercredential_accessexecutionspyware

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2