Extracted

• • Target

    NerestPCFree 0.31.1 fixed.exe

  • Size

    231KB

  • MD5

    08dce587975cb4a6cb1333bd7d3aea6c

  • SHA1

    4c855f6bb5cad027522d0a063cb4f1cd6e97b163

  • SHA256

    0c6e6a1c2c50a0a1ab3f74ea0985e14003921c3b7f4e427b56c7673439accb8b

  • SHA512

    19f21d6f976a971f4bffbf74a7b6450ec6b6ec02d837422a5c5edbd3fb825e630642e4b840e181484a2e0e47997631ad7012f1f710aa098538164c8998592f81

  • SSDEEP

    6144:xloZMCrIkd8g+EtXHkv/iD4LsUtt74szYKrd4UBr8b8e1mOoi:DoZZL+EP8LsUtt74szYKrd4UBAJ

  Score

  10^/10

  umbralexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2behavioral3behavioral4behavioral5