Extracted

• • Target

    69f81a0239ba12507c8e9aec8e3d1667d230d38daadf50039b7968b2ca5e1b49N.exe

  • Size

    229KB

  • MD5

    cbbf1ff408089c98de723a2bd5720e50

  • SHA1

    a186fb0e8cb8ce8c65c473a07a42b9abd29d699d

  • SHA256

    69f81a0239ba12507c8e9aec8e3d1667d230d38daadf50039b7968b2ca5e1b49

  • SHA512

    92f1df204fd200685a90de370437c255520e33c66dd7e6e667985c14b99ea449d69709591102db0ae91fd35fef70a13c6dea02c3d5a4417b891befc60816f1ec

  • SSDEEP

    6144:9loZM+rIkd8g+EtXHkv/iD4giX9UgGhZq+fiQBFUuQb8e1mLucSUi:foZtL+EP8gI9UgGhZq+fiQBFUT33d

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2