Extracted

• • Target

    93ee149a8f5066e8547d306a306dcf25a145ced96466882dec36af362ca05e8c

  • Size

    229KB

  • MD5

    9b2b8035bbaf9833d6e847234ee5023e

  • SHA1

    6ec9dad5457a128c8efdf78aba65ea587ed9af0e

  • SHA256

    93ee149a8f5066e8547d306a306dcf25a145ced96466882dec36af362ca05e8c

  • SHA512

    e54fdf9a2f86abf67db4cadefd77f89b08753f8c6a6fc6856975e9dcad9f0fa58e33c6bb763536ff5c663befc3ac6b241bfd3ce48c33ebd659b96a9c470fbde5

  • SSDEEP

    6144:tloZM+rIkd8g+EtXHkv/iD4XkeKxfEY3Zmfh8ItBNb8e1mv0i:voZ1L+EP8XkeKxfEY3Zmfh8It3S

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2