Extracted

• • Target

    7b4cd9478c848e355d91674e959c77b0N.exe

  • Size

    229KB

  • MD5

    7b4cd9478c848e355d91674e959c77b0

  • SHA1

    84a02dcba4204f3732e66f62b7de540dbcbdee7b

  • SHA256

    4feb640b309beb1de84d7d7b4894831692eb2e24da68fafa644ff928499d4a44

  • SHA512

    500b2d38d07dd6a43a6dd7248324ff2529f130e539e104148db3a5ca0d17566138688c0df13b4aa4f77297c8579ce1961011e4977aa4d5377fcab6a207ac7457

  • SSDEEP

    6144:9loZM3fsXtioRkts/cnnK6cMlfdxJYe5xyBXKYZd8CNub8e1mqni:foZ1tlRk83MlfdxJYe5xyBXKYZd8Cky

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2