Extracted

• • Target

    sultan cracked.exe

  • Size

    2.0MB

  • MD5

    000142d2c4961a9715157529ee679f27

  • SHA1

    e12ef916e551260a295cad737602c897781cc656

  • SHA256

    dbe3ee56b5cc22b5309005a8624b7cc24f5f7260e9bc38d8d223875f2fb81ba4

  • SHA512

    b76fbacdc4bc8172c948d2d68b2506e4c69b43d4462765dbdab37cbc773c081132b555ed072e39e5a5666f734d62374512d9ae4a0660bc90c8e7db0218bba0dc

  • SSDEEP

    24576:Vof3ZI06UZjoiAuB2Tu6kbRTYnnk2FbMNyBo4kx929bL3Hnx1I88:a/Zsxu0zq5QnJB+kn3HnxW

  Score

  10^/10

  umbraldefense_evasiondiscoverypersistenceprivilege_escalationspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2