Extracted

• • Target
    bruteforcer.exe
  • Size 231KB
  • SHA256 27fddb3ad83e8139d32ec09c8d6790b0ddd177c2e90f84f104c64010f91e4401
  • MD5 1e2b102dcdabbee48cd1308fba1f6719
  • SHA1 b657cdb68bb499c81f3746965ce63db8b8da7017
  • SHA512 7e46052ca1abddd8fc993034cca84fe5d0752629d571a1dd4292a97c6c2a56906a20b7a910d3519ef875dfc1864333d01a8e223c9f18fa7fedf78dd9cdc5408d
  • SSDEEP 6144:sloZML9EBw/S6NtFnEPfCJxg8JhAA1HM0ryurdEwZThANnp8e1mGRw:qoZhYS6NZLg8JhAA1HM0ryurdEwZTh8C
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2