Extracted

• • Target

    SupremeVip.exe

  • Size

    231KB

  • MD5

    c824211fa3c507fee0dea2c75eb0fe53

  • SHA1

    8f43608f64d43b91014c371d484adbe7af1cc3e5

  • SHA256

    83fad99df9cf86912dcc087e5936d7643cba31a82fad2c03fa3efcbd9bbff59e

  • SHA512

    d318d6d7e4010d6df403a6423280104067c178e73ba06691c7739bc164eb5583e0a6114e88c2c67700666730f7fedb8c505f6dd2bf8f0e0cd1ff75dd5c2a08fd

  • SSDEEP

    6144:RloZM+rIkd8g+EtXHkv/iD4ec6piAfboTxUyzzqLuQb8e1mJMPi:joZtL+EP8ec6piAfboTxUyzzqDFa

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1