Extracted

• • Target

    921ba78ef5661ee885d93756f28f7e4df163f1ea910af6c68266f856b112ce76.exe

  • Size

    231KB

  • MD5

    85eadbe66e59f3512bfed3edd076ed4c

  • SHA1

    3fac3f7414bd4ced53beb1d89402524a2b9cb510

  • SHA256

    921ba78ef5661ee885d93756f28f7e4df163f1ea910af6c68266f856b112ce76

  • SHA512

    18ca000aaec36bb3221cd70e042b1dd49ace60ff1469059eb4e27c0af8889d5dc31133827a97a8f146970097b70152e7e65d5286fa0721476c5b8cb06277637e

  • SSDEEP

    6144:RloZM3rIkd8g+EtXHkv/iD4iYQ5ClU8e1mmN5i:joZIL+EP8Jo1Ng

  Score

  10^/10

  umbralexecutionstealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2