Extracted

• • Target

    gorebox.EXE

  • Size

    431KB

  • MD5

    4522fc4ba239805a83c7209452595423

  • SHA1

    1a57d4e9a57bc7ef167d01928afeeab07bbd25c5

  • SHA256

    7bef7c9f99847e7c368be124992565c4bcd089948d5b1ca1d1c46911c625a5b1

  • SHA512

    a60cca224cfa06659089682637493f968c7de035b3aabcfb224eda4e50873d0c2198f9797a5acf28b7e92ea71ff246aed616fd8ce56d787679f54b6bfcee31cd

  • SSDEEP

    6144:DahOl8p0yN90QEvNIPbKK6lyO0YYO/2IKuaiTPH2g9mfCImdp2vg0FM:DiKty90tyTK5T0YYdIKoCgkfdmP

  Score

  10^/10

  umbraldiscoveryexecutionpersistencespywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1