Extracted

• • Target

    OblivionCheatVIP 2.1.rar

  • Size

    45.5MB

  • MD5

    e1bdb1bb87c0e037710f6305c54c969a

  • SHA1

    9b9f9848036fb35395e50b515ed45169d6883436

  • SHA256

    f139ed18bca38e4e61fa88f94f0a070d217df1c1f647191510253352724ea1b5

  • SHA512

    d839d93fbf3547f84ea465f6e9423b5d70b70e840c9f2e0df906cb8f483ea58524c5c79f6badb1f9b2df7a0e7b640904ebca488e36a07dc2dd62edf0f74ccc13

  • SSDEEP

    786432:u5r8IfJQOhn0irjgZzaSiI5RTbhVRaqm9hrb/CU0ItR8uZQouD:gRJhhnPruJXByqgPtR8uSD

  Score

  10^/10

  umbraldefense_evasiondiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2

• • Target

    OblivionCheatVIP 2.1/Addons/Microsoft/WinMaps.admx

  • Size

    2KB

  • MD5

    5a08143f3fd10007d14526c13b873e78

  • SHA1

    7286e0823164400f7dbb5eb31e1e87a586913098

  • SHA256

    dc368259c70a4dcf91b04f71a80961bb0dd8233092b01318c43fe01f6088e255

  • SHA512

    87027f48cee30f40edef797f0b482521456f5749532ab8a5606aebe6535c3e0d7b23b9c979f06c40ac2aca11ac5c450c8456c59b70a49c187e06f81d0380528f

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    OblivionCheatVIP 2.1/Addons/Zlib/6.5/Oblivion Client - Installer.pdb

  • Size

    12.7MB

  • MD5

    0b86101c486e90d87a8d3de0c9d279d1

  • SHA1

    40360ea9cdcb3f70cf5a812959a7d29a85052bbb

  • SHA256

    e22051a1221f42955ffed82b3614569f18737cfd424234cd4c90e8542785a08a

  • SHA512

    93ee08c84c2cbe0670c7852d53a5e77d4a43043aa78989d669bcdb77077ef1dab153c9faae96c1d8cce6a191aa75624a28893ef81ef5dec325f9dcd07d6f2d82

  • SSDEEP

    98304:GpStuA7r2KfcgQS2F558lGVrVDclE3Hh0NGpH0n428peJ/JAkMGS0xLd5YlVanQ+:hbzz0Igcj5TpUr7rxxYkq

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    OblivionCheatVIP 2.1/Addons/Zlib/6.5/imgui.ini

  • Size

    1KB

  • MD5

    cdd2786e6177b185b349437551c43b4a

  • SHA1

    032e72c2d469bae81d7c9ef89fedd6dd0867203a

  • SHA256

    876ff105a74a5135ecf2bdd650a8312d353d887f410e7d0535dc47ce5bbf9337

  • SHA512

    2a5bd47f0df40b5f51560614358f92a29ce8fbbecc1c6bc5158297837895b7b3c5ab009697c585618b755bc26a39d3d1db0777884cdbc272f5f1ee015ab14f75

  Score

  1^/10
  behavioral7behavioral8

• • Target

    OblivionCheatVIP 2.1/Addons/Zlib/6.5/login.json

  • Size

    23B

  • MD5

    1f27b170426a8afbab13c8fb9f0fda4d

  • SHA1

    d4a1ee28812feec9f26de2696f58574f63bd71d6

  • SHA256

    fc4d31fe0e2f82e79f8a257d579552dc6bde6f2477ec81f208debcec4aae40fd

  • SHA512

    a46f917eef10bcb4695eac885ff4367a5e63536ac14cf4a59f91447e88b9830d2d351c05293516f0a2c937d118774128da09db045ac99788c6f4ee3211a60f44

  Score

  3^/10

  discovery
  behavioral10behavioral9

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/_mingw.h

  • Size

    3KB

  • MD5

    3b4e52eaf66a0434ef4bd79587b95243

  • SHA1

    c0c21c145420487f4925e8b8f05e4eb5cae63fc0

  • SHA256

    f574410ada4c9ae430b17af722102f6b9dc749d7ec8dfe45427e51e269abe034

  • SHA512

    333b50e44756a6763ebab63719aa2f22332301fb4ddb8b992d10b0685878765eb22e5e56c540ca4ff1d3cd79e7cb7bd119845ca97ca13a270ac3c24d401220e7

  Score

  3^/10
  behavioral11behavioral12

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/assert.h

  • Size

    1KB

  • MD5

    b7502a70ef825c038beb2fdb7709901e

  • SHA1

    e6ca39e6c556e0ecf758c5cf3661cd0c5e0fdf19

  • SHA256

    a0b726d7f82beac0cffb550c33ead8f23186fd941de5216fa48da97a25995650

  • SHA512

    67348abfeea1d22715d6a72423dfecc9db691b64ec1d39ea418c6f04b44d9d8cdb649beec601cbf3499c327893cc8af6d9ecf68d2400003fd89ca43a34b30478

  Score

  3^/10
  behavioral13behavioral14

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/conio.h

  • Size

    10KB

  • MD5

    6a61e54ad2614ba528414c7b69147caf

  • SHA1

    242479133484e15a2af816d95ddb053835bf4c64

  • SHA256

    de7161f85835d98b38fe6a19ef8973dcaf58ec237b1c91cf05ac535b2ff3845f

  • SHA512

    468702a606e20ffa893054f676c56dfe6eb3d28a002bae143298422ab388a2f2f78e318714f5274bc9ebd243863f5228d5ebead5f31d892e96d8742c8e6846a1

  • SSDEEP

    192:R9IFnJJzpoJItwJ+Y31t1d1uF8sFX9B17lHLQWq4QcHyQA3sG1:XI4IJ2WzPw

  Score

  3^/10
  behavioral15behavioral16

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/ctype.h

  • Size

    9KB

  • MD5

    22e5a00491e32d15b40b196397ad01c1

  • SHA1

    b0db6fcbf4abd2f4fdea2771399c1e502d9f8106

  • SHA256

    4cfaaa43b3f7414984126e8b1cdf65f9dac0ef68d9a3396be0b8828376a74a6b

  • SHA512

    28839104776441738233334a20de6ce3ada51179fb50366c27ab60432949fc78e1ccf735d2e80216f8779d84328634005c322d0010875e8fe0ff33d699ecc114

  • SSDEEP

    192:aK0sBzLLoy8q3JHZDrs+UAt0g7WnBeaIlzjD:EALLb8ars+Flzf

  Score

  3^/10
  behavioral17behavioral18

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/dir.h

  • Size

    952B

  • MD5

    ef5c7267df270272bfa8f8ebd1b516f2

  • SHA1

    1e3f8a9afd814efa8cf7c88dc480e9914a5bc570

  • SHA256

    84064b17e501d691c43d47e45b112c2884db467417910b5fa1482b72342badfb

  • SHA512

    8ca2b0e08b66eaa843fc7ad0f8f4063450a469914819a637aa3f8cac39dd38e32cc0403f2b04f767ae486934026585b56f93544c8a1f5d92cce32ce84a4506f4

  Score

  3^/10
  behavioral19behavioral20

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/direct.h

  • Size

    1KB

  • MD5

    83679da78aaf8f8352acb1883b9ef868

  • SHA1

    fd89079636571a93755120120ab4f03b91076478

  • SHA256

    179c3204312d7cf8032102773629bcb3e5fff792d1d808931cb6619a431d2435

  • SHA512

    13af1f2c118e898e6055ca61286c9766df75366ff4f30708f613193cd8f89afc4a4cc2fd31fc3ac6dce5d577ee83e203f79aca3b739d9d9e9e60b42cd9c7036e

  Score

  3^/10
  behavioral21behavioral22

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/dirent.h

  • Size

    3KB

  • MD5

    afbe32ee6ded8cbad33d6fe3fbbf077d

  • SHA1

    a7f0d3edee5f49e127575eb25e64e2747108e7c3

  • SHA256

    88c1f767fdcd6d51b991ee3234792da48c8576f5f8816f17a42344f9c8bbb1c1

  • SHA512

    f655a40f8c87a0cb43a34ae47612d5cef2cf7814fd2ae9ce1c8566f97f45e91470364bd87e8c12861cce44fb8cca54717546baacc6ccbdace51d0d15206304dd

  Score

  3^/10
  behavioral23behavioral24

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/dos.h

  • Size

    1KB

  • MD5

    3b6fbc94238df0fd001b04d55bc899db

  • SHA1

    231e18ce6a5488b2353fb9ef052fd6677c2cf555

  • SHA256

    3afea4ae85c68987fe59f40592ac5ea3ef1049b4fb72612bb185358d628e2dec

  • SHA512

    28ba3ed6cc9511f17798822fa81a2d16da17ca4af9da64f3edc9170fbb883801bf07390214c54b58a32251e6a1c3bb359cb76e892ddb77fbf8c1bf3985e13e5e

  Score

  3^/10
  behavioral25behavioral26

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/errno.h

  • Size

    1KB

  • MD5

    309538039188f5e3cf010fb1b0c7cf66

  • SHA1

    2ea79342c5ffccdb1c4bc613f2d5d55cb45c0117

  • SHA256

    ddacb88c325b09d6c7482e446c877c4d01328a28d803332ca38c54b428d1b8b0

  • SHA512

    ea9ec288e5963ae2ccad77ec255bed04a1051ea7d70bed6e6b863f8b9da829d4a42703ee66f9b14873286651ca5bf9eb0c89d400735b95534f6724c9b860cf19

  Score

  3^/10
  behavioral27behavioral28

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/excpt.h

  • Size

    3KB

  • MD5

    d236372cba09e14c37b4e48f81baef83

  • SHA1

    11a3bffaacedfa1caa4b4bb836cd95297a4ecc6d

  • SHA256

    0098e51602c94f8a9702f4b776d3630f56eec27ed67b9fc36d9204933b58ac4d

  • SHA512

    d7c22525fbb97bf8950db69645511420f1198abe33f5d0fe07a5ee8dd6b5cda07038b6db71a2995c6f5ec1b85d8b98e4370330193132e95f2a65e3a847f04408

  Score

  3^/10
  behavioral29behavioral30

• • Target

    OblivionCheatVIP 2.1/Compilers/tinycc/include/fcntl.h

  • Size

    1KB

  • MD5

    478add63d2c741d03a60a11bdc4fc0d3

  • SHA1

    e9e0c857d2c409f23c346d81b77c5634f1c395ab

  • SHA256

    fbd94f945a57165ac897bdbacd2a861b1351e7850fa76752703c0a622e0646fa

  • SHA512

    bccc563718b1a03e93e5bf8cf0d79bb3128a3fc1fdd6fbc17792cbaf3c5de70de06ec2f88d8eed7105ff62056e32e9a79570f5890e75f4443033421d283b2fec

  Score

  3^/10
  behavioral31behavioral32