Extracted

• • Target

    Umbral.exe

  • Size

    229KB

  • MD5

    40aeff8340acaf040ca3c3bc883b8673

  • SHA1

    6bee9df7f7d60f9a1b811cb7f10bac5d2c3b2c24

  • SHA256

    901ecaae92ecf398de0be871e6d1aa0de8598b46e9111b8f9db73320f3b0c051

  • SHA512

    83df0f03272dda85969f6928afd5c91da7a4b8d34f1a6ed7b7a88369480d1f0fb2549a7cbe8c80598cb3e300b2d703e6fa4cf598fee7aad15879d0a0213c964c

  • SSDEEP

    6144:lloZM9rIkd8g+EtXHkv/iD4KHutxdt8e1mBuJi:noZOL+EP8CSxfc9

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1