Extracted

• • Target

    Nursultan Alpha Crack.exe

  • Size

    494KB

  • MD5

    e6884786b4fca76e3752225aa2f24abb

  • SHA1

    a089d0818839ee52bcd0d8156fba1470c2f9ba3c

  • SHA256

    fd0bdd761b727b568e5d9d572aabff62177c4208ce2d1b281d278379b856bf5a

  • SHA512

    e41ea86252a735f8a03625ba79b65a3a790663a03d66f7f4c36ab8a94244944bcf75c6389e448ce962f523120dc8cb2787c2766f12e7e6667276a038209395e6

  • SSDEEP

    12288:doZItlRk83MllBazCg/7IsR0STTKI7AY/rXi7Q:r5r3kazCg/7IsR0STTKI/rXiU

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2