Extracted

• • Target

    Umbral.exe.bin

  • Size

    235KB

  • MD5

    c4629d5b68b6564d03651b30e7a421b2

  • SHA1

    24d0ba44fc82a268cd5bdc3e39cd0ff4d96f506d

  • SHA256

    2a45fd4f683e43f40f69ad4b5fdd49fc7c7ab38ad5b9fb2243903889d2ef13a2

  • SHA512

    4f2e0dc33c9896e181cb30554983c358d7d0a36d7e33282c902d7d92cd3a19676301776b81a3f03c0431d3fc825b6d9cb9cb884ef4c499014079d91302718715

  • SSDEEP

    6144:LloZM+rIkd8g+EtXHkv/iD4LiDnwf1DA0r9SjVg8ZJHELb8e1mNZi:JoZtL+EP8L0nwf1DA0r9SjVg8ZJHul

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2