Extracted

• • Target

    KatanaFN.exe

  • Size

    229KB

  • MD5

    8c6c893c1be31f8bba39f50c79772e34

  • SHA1

    620d857c37fc74da24b5ed43ed6c1113482e086d

  • SHA256

    57953e9e139137ade941f8e70164fc8c06539927bcabdb3e5ee753e8375e6f6b

  • SHA512

    e6e4f12a8723799662ecbbfee529bde6f5e5cd3d49d851c7203c73f49c41c1133bdd3b5d19c82608b0df79b3c6cd3618dc5a41f4678128200c02188c8fd16e67

  • SSDEEP

    6144:FloZM3fsXtioRkts/cnnK6cMlTX7nmkrHMI9YW3X2Xws+lO8e1mUKAi:HoZ1tlRk83Ml77nmkrHMI9YW3X2Xee38

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1