Extracted

• • Target
    6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548N
  • Size 231KB
  • SHA256 6e44577b67a2078fb7f6fd18aabdd9e03cc1a5ff3b2549ac4c1172171e9b5548
  • MD5 bf88437e7f3d92105674eb1d1898ad60
  • SHA1 b05bac32adf9ac7e6d43ea6125e3990d8eab252a
  • SHA512 8b97ec767712e8a2e88c22c9ead351a17c21b2b6714b65d440bd9d3555601b7055209ad6dca70d5c4c06425a67dcfba15d6cc6c773d26ee0997c911dc29f212f
  • SSDEEP 6144:RloZMJrIkd8g+EtXHkv/iD4vqU5EKtFunr20VJggTI8e1mEi:joZCL+EP8vqU5EKtFunr20VJgH6
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  umbralcredential_accessdiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2