Extracted

• • Target

    tempspoofer.exe

  • Size

    231KB

  • MD5

    32e16912b2393c29fe60bbd22ae78e48

  • SHA1

    cc08bc0e843139864445f703dba130956c605be0

  • SHA256

    3df7f52703498423053930ac726878d23436a8579ed46ef247391c2b2536c596

  • SHA512

    f70da345c4345293b87a8b5f49d419b1cfd53e1dc9e30f8d50d97a2d6d84fb55356acdabd0df828ab57a22add86786207624048afd490b196ee9f05d6462a340

  • SSDEEP

    6144:RloZMMrIkd8g+EtXHkv/iD4oxXVoOJBiPHaIJtME/lb8e1mBi:joZbL+EP8oxXVoOJBiPHaIJtMCH

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1