Extracted

Extracted

• • Target

    resembleC2.exe

  • Size

    763KB

  • MD5

    f70fb0eacdba5672bd67ff9ad29e425b

  • SHA1

    35c7ad26473afb12c8b46dfb51f3e0d73b92a7eb

  • SHA256

    325ec7369a18af43c95815bacf830f5bcd1093436c25f67685226fe0d4812280

  • SHA512

    e93012796de946c4b009d9c68a539ea010d88952c11ddd0fc05d3d4ebe1657f16a7f75269e2c6075c12564f40752c7f4aec0c64583ffb46d06ec69431e5f6ff5

  • SSDEEP

    12288:wjB1GbyBRc8nAVCCpViLkSdIi/NvFFuHtHylX5mmYKlzQUG1R9qRst2hmKyL/mVD:wjB1myBRccwf/SdNFvFFu1yh5zlzY1RS

  Score

  10^/10

  orcusumbraldiscoveryexecutionratspywarestealer

  • Detect Umbral payload

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2