Extracted

• • Target
    cheatupd.exe
  • Size 3.8MB
  • SHA256 5a4eaf32d0659b7901cf0c8414447abf7729f191ee9117afdabbb67d10367f27
  • MD5 41d85a23571e09d57856ccf8706e87a8
  • SHA1 1c0bf5e822fbc8e1b5b65822bfa6fea3c169c365
  • SHA512 fa292cf02ace641f9b47c9762afcca28ff71db80d478a6ca8d09f016325df881d7b959b12b9315544a13e9e6f8d0679b0ec82d0583360d0e00586d7aa20af4a0
  • SSDEEP 98304:gjga7NF3jhPcyWSRY0/XOjfumDSC8Vb9/JvRie:mZF3OyWAZQfumf8ddJvRie
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealerthemidatrojan

  • Detects Umbral payload

  • Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Umbral family

    umbral

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2