Extracted

• • Target

    01a6455f4129f57c14f06015e35574ed431d9d003bdd28a842f6363a227ed21e.exe

  • Size

    231KB

  • MD5

    302d470d77ea2d4d630c24a0ae972dfa

  • SHA1

    ee69fc69148e3975c5bac47c9adb9a54b23b0e72

  • SHA256

    01a6455f4129f57c14f06015e35574ed431d9d003bdd28a842f6363a227ed21e

  • SHA512

    0f4d1b7a46233e63295c8a71559a75c4ed5dd2fb24810fd44f99631d2de72ac902bd1ed9233d5fd0dd76e0c357c49b169ed184a89f6794a48c762e02a7b41f39

  • SSDEEP

    6144:RloZM9rIkd8g+EtXHkv/iD4vhjKEKtFuYr20VJg1Jb8e1mtia:joZOL+EP8vhjKEKtFuYr20VJgPra

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2