Extracted

• • Target

    Luciano.exe

  • Size

    231KB

  • MD5

    c5c17fc158c3086aac72e74186863dec

  • SHA1

    65f0235d98e9e6627180fa7880e4722e70785f60

  • SHA256

    8550e87dd9fdf57261a475e8a656d529a7872e387eea53997649b5c0c37a0422

  • SHA512

    448a6f4b4b89446c281bdda023713e2c7870287a9ceec6b3d130fb185ee7dda40fcff92e8d1c9cc0bae6945f09e48f78030d8899374297136b0c07878283a533

  • SSDEEP

    6144:3loZM+rIkd8g+EtXHkv/iD4xQa4SQPL4ZBECDjatC/b8e1moi:VoZtL+EP8xQa4SQPL4ZBECDjauK

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1