General
- Target VoiceBoost.exe
- Size 375KB
- Sample260425-mlq4dsft51
- SHA256 1fa1ca42abac4f9bb826940e36893d4e6e2612a6cc314c490e593b2834027082
Score
10/10
Malware Config
Targets
-
- Target VoiceBoost.exe
- Size 375KB
- SHA256 1fa1ca42abac4f9bb826940e36893d4e6e2612a6cc314c490e593b2834027082
Score10/10Detects Umbral payload
Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
Drops file in Drivers directory
Disables automatic submission of suspicious files to Microsoft by Windows Defender
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.