Extracted

• • Target

    Umbral.exe

  • Size

    229KB

  • MD5

    fd99541be9d7e3690c02aacc9b25fb64

  • SHA1

    d1031c9cfde65a08f2682727dab72fd0373bbaa7

  • SHA256

    d9f33d5d2633fbb0038ee965a140a7a26e2f28b10aee8b3ea0e729452128d19c

  • SHA512

    d2a8cb3d82874475ee955831e952834b4626ed0a0931f76ee38a910295aacb39e4e6da60598df1335e840685ece7d8394e3b64272f5172ceecd78d257b944245

  • SSDEEP

    6144:9loZM+rIkd8g+EtXHkv/iD4DMw2KInDAPZMK7bCR9b8e1mogi:foZtL+EP8DMw2KInDAPZMK7bCnz5

  Score

  10^/10

  umbralstealerdiscovery

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Downloads MZ/PE file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2