Extracted

• • Target

    BootstrapperV1.11.exe

  • Size

    229KB

  • MD5

    224b37147484176752b12af33b9efd96

  • SHA1

    d2fbb87ff49e0e80e8585b449fac349688d02f23

  • SHA256

    2133a2c5f4a04d8ffe1ea436d035917ad16c50fa011b021c95c71f2660e67033

  • SHA512

    e374e69dad1b3ad39887163e6c8cd07a88e36b167b91b0eeb8a5296f7345ea4c97e6e8e009193b321524f5326118900933e4657b0177b702036525d42c508704

  • SSDEEP

    6144:9loZM+rIkd8g+EtXHkv/iD4lePZsyVtG/TOMdRYz7b8e1m4i:foZtL+EP8lePZsyVtG/TOMdRYDu

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2