Extracted

• • Target

    PaypalChecker/PaypalChecker.exe

  • Size

    241KB

  • MD5

    51b45616b6902c84fed4f09c0ae52fca

  • SHA1

    39f490a578c996ec11601b203c600c7746cb9802

  • SHA256

    4b7bc1185048cb51fde3554326846cf426d7e1d3aa372349adb8c6e921762ce6

  • SHA512

    b7e6e95072e0b27bb2aad79e6f1ad6f17000bd724e752679ddaead7c50655e52a37b5b082db7c1173992873bc4c61ded852cd605b4b5620f176772be0d31df31

  • SSDEEP

    6144:wloZM+rIkd8g+EtXHkv/iD4YMVIp3cw/9eHp0AV39b8e1mSfi5F:+oZtL+EP8YMVIp3cw/9eHp0AVNpKr

  Score

  10^/10

  umbralstealercredential_accessdiscoveryexecutionspyware

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2