Extracted

• • Target
    Stealer-Server.exe
  • Size 293KB
  • SHA256 4792ead452ce51d22f81e858892015c69500c221340b4f3104cddf724aec0630
  • MD5 0703ff25d816a614e7569dcc3c2901b2
  • SHA1 37d1511be16b9405f8804b347f8a415e706de514
  • SHA512 1f852211d602b08aca337eb53e95f2c2c16f00a6f695e72c00a2253d0b60f1ff81e2581d41e16f00c7d284c50c2c67d64ee0f2361e4ea3eb675d359126aab21f
  • SSDEEP 6144:GloZMXXU9Zx0kt8X0/PSCsM2iPfoOJBitHaIJtMlm6b8e1m9n4iU:woZDf0kkP3iPfoOJBitHaIJtMEGinB
  • TLSH
    T17E544C452FB88A12ED1F8BBD956117CF87B2AD03E90AF78E0C4874E815F27419849E5F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2