Extracted

• • Target

    WindowsFormsApp5.exe

  • Size

    8KB

  • MD5

    ef8b399d71141333959e41ec67917581

  • SHA1

    896e70fe19495589eb4fd338f0ca4a09f406f983

  • SHA256

    68be9bbac51892ca8e7f461d1509ae1058ba7b0a435658beebf10423ff5bad01

  • SHA512

    7fa42a455bfa0c7e7fa8c67cbd0f2f3d61b8cf9afe8974e2f7a8381484a76adb3f155d71128599734d9b1b2e4eb494ed33c64f0f8148c1cf964cb57925d2fe16

  • SSDEEP

    192:uJy2O0tL1YLu0pWzkLzLeLo/rrVCsfznxT12a5k:Ey2XtL+LjpWzkLzLeLorrVxfznxc

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1