Extracted

• • Target

    selfbott.exe

  • Size

    227KB

  • MD5

    e8bf31ef50755a97e720a2272bc2d982

  • SHA1

    7d99287c32962fcb643916817a1f97dde5eeb13b

  • SHA256

    864825be054e1dd6ff62defe866c25c03961ef221975f386fe5385c8de6f8ce6

  • SHA512

    27cf74d9f73677f449cc9bd80d3edaa99b12d8a225e067237caa616aaf85012925a13da3eb6512fbf762e0dc765f85fb76dc5fffe9eff9f7a3aab4733cd35d94

  • SSDEEP

    6144:eloZM9rIkd8g+EtXHkv/iD49gXDR/k4XKG/BcoNgdb8e1m9i:IoZOL+EP89gXDR/k4XKG/BcoNAH

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2