Extracted

• • Target
    2025-07-01_c48e2e42f1c047535ae8f0bef6bdba0d_black-basta_cobalt-strike_luca-stealer_satacom_vidar
  • Size 17.0MB
  • SHA256 ddab7ccd3b530508378244bd2d79d86ea44a5d3f0f7a1ec8285b60c434b9e5c7
  • MD5 c48e2e42f1c047535ae8f0bef6bdba0d
  • SHA1 011238be0218b70f5278e048f4953724b28fe12d
  • SHA512 e37be062f1d9794f27555dd3e0aca4b9bcf853e753de9a544a78cc4bd1b9dd275a7f6d2c9db29819e870841b04d68c38ca7225bd6de25a62e104213311ea05b7
  • SSDEEP 393216:DRxoCelFEz8uAR9Sv3385vzAKcSWXMCHWUjoGwbIG8:DRuCswe5vzAKchXMb8oZb
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  umbralexecutionpyinstallerspywarestealer

  • Detects Umbral payload

  • Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2