Extracted

• • Target

    bootstrapper (1).exe

  • Size

    328KB

  • MD5

    0cf5a2a6a93219472f252664fa75255e

  • SHA1

    38f94656d8c9be377161306d1b9ab5feb41f27ff

  • SHA256

    fd39268f5d2b701b75d72ee97b20c325b72af61aa69b9638e04ac2816927c483

  • SHA512

    6ab0c66dc057f557b33749ff493b579e284feda4541ca576fdf96ae5c8ea2611141abdc82bb8d423504c00dd5c3648209347d549511e889a66efc6af398c8911

  • SSDEEP

    6144:SloZM+rIkd8g+EtXHkv/iD4CSn6HdmOhZU9va6v8Rb8e1mZi4c:8oZtL+EP8CSn6HdmOhZU9va6vs7

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Deletes itself

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2