Extracted

• • Target
    booster v5.rar
  • Size 95KB
  • SHA256 2f56976dba3262f8d93b56d871c7b5e3bdaba02b5c1ee41ddf1bf29021f3ac51
  • MD5 8aca74e7f0c7b08ae24353721c698169
  • SHA1 ab9def94e269cb0c04dbdc03d68da95f67ec3f61
  • SHA512 b53bb6e69eae4cdfecb1a1365bccd42beaf859d32166ba73b9c93b13336cea943ce2376af309516da55333ed98e94ddce1d020068493d2a05a3f1f18710c1aa0
  • SSDEEP 1536:yhwoVIQUvzY3t95r8ab7cicyzgQJfo6riXSv1CDy8+BtE31qEYUjTkNBqLO9fO/:aXVD3Rr8Y/2MTri8uyDtE1qo/kiL4O/
  • TLSH
    T1FB9312A9F9C9B79414E3AB28DCA04648C6F907C0BAC331AF495F30F64763389E55456D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    booster v5/boost v5l.exe
  • Size 589KB
  • SHA256 52a857e9310a1350b2b9da7a7769cbccfdd007e56b2230f1cb0855066642625a
  • MD5 bfffdf3f941248c630f5921e318c3790
  • SHA1 2f4b1e84fc21fb28d5ad31a73b9d42fccffd881b
  • SHA512 d8670d2602e90fb72edb2aed98f1ab9e0a9240d6f7ba9543d47808314b0623f4ae8c91a551bb503ef5a8f1a9fe2fb834923fcc6fd3a8688d3d0d8f6a9b119e93
  • SSDEEP 6144:3loZM+rIkd8g+EtXHkv/iD4URJkxfEY3lmfh8ItXkb8e1mnildQP1:VoZtL+EP8URJkxfEY3lmfh8Itk9H
  • TLSH
    T149D4A36235248C82D0BFB7FAF41EC12942616D8FA7EAD30947F57DA6E0D37434C5AA06
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionumbralspywarestealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral3behavioral4