Extracted

• • Target

    Cheat.exe

  • Size

    229KB

  • MD5

    57b52820e80bbf21cb91858308b64a43

  • SHA1

    681de078a2bab05ff51d6b211a6136cd0a4cf5c5

  • SHA256

    cad17c73e90686eee88e8e73039d69d0969a544a20d324cb30efe4849bf22be2

  • SHA512

    981daa6346b6887d92fc77e865a9de661ebdf5216cca2c05a2817b28833a02a07ae5c64d181990dd0d86971e740a44e709b058a50cbef146066e00bce6628454

  • SSDEEP

    6144:tloZMcrIkd8g+EtXHkv/iD49XVt8il92+De8NhoMi2b8e1m4ohi:voZrL+EP89XVt8il92+De8NhoQG4

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2