Overview

overview

8

Static

static

1

EpicInstal....1.msi

windows7-x64

8

EpicInstal....1.msi

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    EpicInstaller-14.2.1.msi

  • Size

    152.5MB

  • Sample

    230204-y4ghfsed95

  • MD5

    353c216084477014c75d7d7545bd7353

  • SHA1

    2b6ef6d830e7f0783eadb09d9b6134c91e0163c0

  • SHA256

    a60db9fc0b290f4bea8bc5729b6878d97392156979c1a47498bb27269e16915a

  • SHA512

    83c0ccd20db7b6ddfeed821b763040dbff9b25549ed5d0bf292b7138e1db405432f7a6e7a45ba9c471af7ccef3ba65f43662cbd51b50225aa21e573176cef090

  • SSDEEP

    3145728:2yQOdRG/1UZt0MKOC2HOfiLRNOIflCO6BKiew2WOMVweEL:lqUPrlHROcwO+5z2WOMG

Score
8/10
discovery

Malware Config

Targets

    • Target

      EpicInstaller-14.2.1.msi

    • Size

      152.5MB

    • MD5

      353c216084477014c75d7d7545bd7353

    • SHA1

      2b6ef6d830e7f0783eadb09d9b6134c91e0163c0

    • SHA256

      a60db9fc0b290f4bea8bc5729b6878d97392156979c1a47498bb27269e16915a

    • SHA512

      83c0ccd20db7b6ddfeed821b763040dbff9b25549ed5d0bf292b7138e1db405432f7a6e7a45ba9c471af7ccef3ba65f43662cbd51b50225aa21e573176cef090

    • SSDEEP

      3145728:2yQOdRG/1UZt0MKOC2HOfiLRNOIflCO6BKiew2WOMVweEL:lqUPrlHROcwO+5z2WOMG

    Score
    8/10
    discovery

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks