Extracted

• • Target

    MIDNIGHT.exe

  • Size

    230KB

  • MD5

    7b96b2b4d1a942f2b3cb34678bef7a81

  • SHA1

    ce236036608b846f9efb0892684f793dfd6eaea7

  • SHA256

    5971cfc5a8c3803c278136912b255f50c29ed4ab30e5173d723d837deffacf5b

  • SHA512

    28508d5504743721dcf82b5c6771037d1dc7140ddd8de079004a1c55f2a7ae3d2ebc92c40647387819a51f3c10f0e33a543e1e9e5248ec1282423a3e03553c1b

  • SSDEEP

    6144:eloZM9rIkd8g+EtXHkv/iD4DSB2zZqStoY5rWWDJ2b8e1mYxi:IoZmL+EP8DSB2zZqStoY5rWWDkM

  Score

  10^/10

  umbraldiscoveryexecutionspywarestealer

  • Detect Umbral payload

  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1