Extracted

• • Target
    Umbral2.exe
  • Size 227KB
  • SHA256 98dbc9d2d68857c2d0f61d9f8fdfbc434ad529cf05cc0b2a1ad61d5d4f0618c6
  • MD5 5b76081a85a35dbaa135423cd55190b9
  • SHA1 9cc3741c96853bb7ba6c94e4c8f472722e106431
  • SHA512 e2a44c7eea97eeb4311a5a4a5dc0f0d2c4013d7c1a1018f797e5e408efac50ba4a8b8601e064d72cf8df5afd570990fd218b3ece816a9f235b50650d698c192d
  • SSDEEP 6144:+loZM+rIkd8g+EtXHkv/iD4EMk5OsTPkZFQu//OTQKb8e1ms2pDi:ooZtL+EP8EMk5OsTPkZFQu//OB+pO
  • TLSH
    T185346B5933B88B17E26F8BBDD5B1149F87B1F103ED0AF78E0C8895E82412742E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1