Extracted

• • Target

    Umbral.exe

  • Size

    230KB

  • MD5

    38b42800e087dcee9961a8e80318d6f2

  • SHA1

    36893cfd322a6021d8048ca6971fc094de6a9f7c

  • SHA256

    44a1693b64e6cb0054ab2d7188af6c9f213ba2a65cf278b6f3857ab462cf30a2

  • SHA512

    5c1d1065e8d076abeabe473f184e7561a2bc9b8b1486b3bff7540e736aa700a93a4879f97f70e176044089ca6eb0462725f26cdd3cb78190de62a62252cb6039

  • SSDEEP

    6144:uloZM+rIkd8g+EtXHkv/iD4K8Nqbw2xpapPyAxVkK6b8e1myui:4oZtL+EP83Nqbw2xpapPyAxVkdXD

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1