Extracted

• • Target

    clenor2.exe

  • Size

    251KB

  • MD5

    42c9654eb3298b8d5f4d16d1ed0d749e

  • SHA1

    4fc97a7b2620c1ce483b1cc0ec18ce72c95ad74f

  • SHA256

    f637e4110044a636ee310796ac7659d7b80a2e9ece59d47287cf6b4fe4bd35e1

  • SHA512

    2e2ea79df165f7431aea4663c7cee5e43df0510ac2a03e17ff9bed4c5ffe1b9174bdb9060e985c831abf36cbf0942b1fa76da2d30b277e26b2b83a632aaf0599

  • SSDEEP

    6144:TloZMsrIkd8g+EtXHkv/iD4xxfibhS6FHAxDeebc+Yb8e1m0yi40D:RoZTL+EP8xxfibhS6FHAxDeebcX7n40D

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2