Extracted

• • Target
    https://cdn.discordapp.com/attachments/1515750761487929646/1520535968224907446/WinRAR_archive_.rar?ex=6a418cf9&is=6a403b79&hm=ad008664b3af0f053641c8153772e33586971df3eb2f029352368cf35b209d93&

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralpersistenceransomwarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1