Extracted

• • Target

    PhotonExternal.exe

  • Size

    448KB

  • MD5

    114977c4b8e58661eca598e3e864ccea

  • SHA1

    f4cd68a7a9f39252b3d9337f6d4bb1f2b2ba66fb

  • SHA256

    de0b828a0c5a7de9ee5cb878bf53c26294106ba05d1cc1d09e34463c6bb37e45

  • SHA512

    7e5730e53a6c3b9f444659f81ab582216f54ee36b2d6be59893cd93711ad2dbe125d00ca4107238324321e661a3783cf2b6de6c4f9469fad7677e7a2965bf988

  • SSDEEP

    12288:7oZtL+EP8q6BoHdmOhWU9va6vAZQtPgkFDIknaHeELrvajxzp:FI8hBoHdmOhWU9va6vACNF5niecmxz

  Score

  10^/10

  umbralstealerdiscoveryexecutionspyware

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2