Extracted

Extracted

• • Target
    iVCam_x64_v7.4.3.exe
  • Size 44.3MB
  • SHA256 dd502d6c75143d9713efda05271c7a6738ecd3026d5f9cafdfa747670d7b6d67
  • MD5 feead32367c9346ab5aaef430561f4e3
  • SHA1 a02a472ffc0105a1cee67a6c4eb21625ed3a19ea
  • SHA512 585659ae9e144fdf564ece772208a2e5afb33d4d4acbcaef65e5a5d4eaacf5aa71da61066f8cc032c5c7309848489d7b04f28cd1af09ddb0923c250b31bc5677
  • SSDEEP 786432:nOlz8wWq+E4klaSnzM78FywuVkIBEtlaiOHBMLqxuHkGwSU1R1TSoLHEdA3HOzMl:w8wWq2YaY47gy/G7jaVHjuHkZSUHAOHN
  • TLSH
    T115A733FF730D9E74EFA9A038350C65F95C5C2E3AEA4878D8128A76B06477CD24393586
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hacked by rshwhdiscoverynjratumbralinstallerpersistenceprivilege_escalationstealertrojan

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2behavioral3