Extracted

• • Target

    NeverSense.exe

  • Size

    231KB

  • MD5

    7414d4b850e9a986b199a741613a5fd0

  • SHA1

    797ac658f7371c68e64e94b1ac5df8d80b120710

  • SHA256

    a68b90e0481fc97117d68b197e3149e98f9040ea0b1b70f83a1f0de9825124d0

  • SHA512

    ecec7ad30472c366a9bdada5de639471efd207a297c7652f17343bbd83f94b0486ade175b40272a31c052b7559c32ce4bd9fe8be0ad63fccbfb753db41ca6c00

  • SSDEEP

    6144:RloZM+rIkd8g+EtXHkv/iD4YfF8Ye5xy9XKYZd8N3b8e1mu/i:joZtL+EP8YfF8Ye5xy9XKYZd8Bg

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2