Extracted

• • Target
    EAX Advanced HD.rar
  • Size 2.8MB
  • SHA256 c17deb3159afa6cc3b26863de0aa8be542fac24a42573802a8f293f5b9cabc84
  • MD5 c5de502de2e5e159d433e2508d48b912
  • SHA1 5221a6ec2f93d6dbaeb347024480cfe850279357
  • SHA512 a53a68635d510ef7934a78f04cbbc122a6108cad1fe9139c64d194d2c725ef7060f704c59a473d0fdd899f2f0f181981250051d175e2535c6fc4e1414fabda0c
  • SSDEEP 49152:eqvgUMt9lwQcmeDAhQwQY5s4S2QimGSxuVKJByxhwlW2MgJwegLQjQD3b9k6s2KE:eqvrMfcmRxxa2QimGUJMxhwlFweLjQD7
  • TLSH
    T14FD5334B30EBB2FA160D9049ECC37BECA74DCB4A809221D1456B84537D7BA1DB54E63B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2