Extracted

• • Target
    InjectorV2.exe
  • Size 229KB
  • SHA256 e9145e4a8eead07ac13d4a890581bf8e0efed8f5b848599c6e281087de93e6ab
  • MD5 13cf8ba41cea1cdf45563ef41474ef32
  • SHA1 fc5933849e53851d431308600d69aaad9acf1e80
  • SHA512 81bd1e1602de62b70c0d36e27ea5b25a20e3ff63c0fad6ee313ae99334ab82f1021a4376301451e04ed62721d150ea3d84defda66edd3589928ea9274b7ee4d7
  • SSDEEP 6144:9loZM+rIkd8g+EtXHkv/iD4N8a/U69Ve4bGkFZwmmb8e1mUi:foZtL+EP8N8a/U69Ve4bGkFZwhK
  • TLSH
    T196346C5933B88F17E25F8BBED5B1148F87B1F143E90AF78E0C8895E82411B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2