Extracted

• • Target

    Umbral.exe

  • Size

    229KB

  • MD5

    50bc3bab2a3553f7b55fbc5a6fa1275f

  • SHA1

    83f6672fee979dec40ee154519c9cd7d3aa79bb4

  • SHA256

    f3073b18151ae854112999b803ef10b70447d908a3cb0b2c27e91740a3fb2370

  • SHA512

    a0c0b1d7b2e9dae8c1e4315b2002eaf2caddd3639986f053f3874e7e7c715e60d20f4893d0b456d7289503146ace6fde934e1f807b5483ff28a592bfac55d150

  • SSDEEP

    6144:lloZMHrIkd8g+EtXHkv/iD4SZ+lTwk7+iTlwsJOhK28e1mmi:noZIL+EP8SZ+lTwk7+iTlwsJIw

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2