epsilon | 4113ee678970bd438e135454ca93f5004b531ebeae76d29b49eb5c32620f5e29

Sharing

Copy URL

Twitter E-mail

General

Target

Sprydite_Setup.zip
Size

73.6MB
Sample

240223-qephrsgc8w
MD5

7055556396d97e5ad2a76a138e362008
SHA1

33824a4b827ee53675908c6c8f618fb4e19c2809
SHA256

4113ee678970bd438e135454ca93f5004b531ebeae76d29b49eb5c32620f5e29
SHA512

96423a698ef0db4955099b3b02a1f506bcce62f84cdb5bea5209bd08f99ef82444f1c7fd3f60ff769aeb80767e0cfb87e4a999f0423a9c726f0f1c801487f89f
SSDEEP

1572864:jeJaQBmO1CxAINmJYMdQNTwBQHIhn+6VdqXHsjzje8wmIwX7FFMW5ph:jdO16AI8YAKsn+qdFbRFj5Xh

Score

10^/10

Malware Config

Targets

- Target
  
  Sprydite_Setup.zip
- Size
  
  73.6MB
- MD5
  
  7055556396d97e5ad2a76a138e362008
- SHA1
  
  33824a4b827ee53675908c6c8f618fb4e19c2809
- SHA256
  
  4113ee678970bd438e135454ca93f5004b531ebeae76d29b49eb5c32620f5e29
- SHA512
  
  96423a698ef0db4955099b3b02a1f506bcce62f84cdb5bea5209bd08f99ef82444f1c7fd3f60ff769aeb80767e0cfb87e4a999f0423a9c726f0f1c801487f89f
- SSDEEP
  
  1572864:jeJaQBmO1CxAINmJYMdQNTwBQHIhn+6VdqXHsjzje8wmIwX7FFMW5ph:jdO16AI8YAKsn+qdFbRFj5Xh
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  Sprydite Setup/SpryditeSetup.exe
- Size
  
  73.6MB
- MD5
  
  4f9d010102270929a7f6d83a19a08310
- SHA1
  
  443a42ca27309804aa2f5e1ae3f311f8ea40040b
- SHA256
  
  feec17a9928ac667b7476b75b0742fa1dcd543a66f6c3f8402f53f2df3d5f395
- SHA512
  
  3097224c1e489bca7d5b504f8f7c3840c8383d825ccd4c63b5b6ebe71eb0ad0e8be9d678a9edd9fdabc9360ad1825fc06dbcdc7e0edb800d9a2d7de03767137f
- SSDEEP
  
  1572864:VejOS3YTcZCc6I8dxEUH61d4rAHmpHWqtnoPR093VKMgEKC5rVzCWVfck:VxTcZr6IWEckYHWknXHd/tX9ck
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  LICENSES.chromium.html
- Size
  
  8.7MB
- MD5
  
  1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1
  
  d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA256
  
  000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- SHA512
  
  ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP
  
  24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
Score

1^/10
behavioral10 behavioral9
- Target
  
  SpryditeSetup.exe
- Size
  
  168.6MB
- MD5
  
  6627212274226bd615fbeb129fb0928e
- SHA1
  
  fbdf80b1efd45e0029a56146e7ef5a7e9f63164d
- SHA256
  
  3a2bced7e4cbd8e8b4c88c63ea034e15daac3da55bde85c5e7a6dafda1eaa01c
- SHA512
  
  5b27af335bf5c3cb4e32520d253c82a37e81f3f48dee7667a959e149a07068904ffc402835d249128c4f5adb3c44adf84d0b550ca3560d8a4a0cf29e2a8e218a
- SSDEEP
  
  1572864:KXic4qb6IXgDaJfpEQHgelkLK4z34xGWw0TwW1T/qWhehZvmCtS3JPfyzG49FndX:UVKvWZ8tyx4u
Score

10^/10

epsilon spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral11 behavioral12
- Target
  
  chrome_200_percent.pak
- Size
  
  222KB
- MD5
  
  47668ac5038e68a565e0a9243df3c9e5
- SHA1
  
  38408f73501162d96757a72c63e41e78541c8e8e
- SHA256
  
  fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
- SHA512
  
  5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
- SSDEEP
  
  6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
Score

3^/10
behavioral13 behavioral14
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral15
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  ba0f13758adb6aec4c6d87749af59467
- SHA1
  
  0b3c725fd344f38f3a62e17372219e3fd62a1020
- SHA256
  
  d25b0f4eabcd8b3dc0e0af492fb1c4870cbbd30f59cd5259e53fe010a2710af2
- SHA512
  
  ef0fd5da19e764cba8e7525f58f543b2a25e49ff84a40f9f09779e20c45fd9aa596cec18916cd4967873ef9c877d30a983c91b06a6cf2b77b16736365498ee50
- SSDEEP
  
  49152:PPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvU7n7xN:PSOONYbQG7m8bdazl7n7r
Score

1^/10
behavioral16 behavioral17
- Target
  
  libEGL.dll
- Size
  
  467KB
- MD5
  
  7906d51818c053d8c99a8491936bc7c4
- SHA1
  
  2e7790d61a8aa639c6a02be0724715302171d14c
- SHA256
  
  66e424b122d13d4be5728215200d3b219fc4cecaa0e6128518d7f8e5600dd58b
- SHA512
  
  23de1a5718949b9c624e8a208aeb92596380ebdc2675c3286163e464f8f334baaf3bc5bec529a7022241884ed6b9c9061036106c972acd621f05385703b628a0
- SSDEEP
  
  6144:TuF2Dw0NiKxN6YTfDVTCanVJhPadWQo+wehJp/Ej4:q0iKbbTfDVJ2dWQo+wenp/EU
Score

1^/10
behavioral18 behavioral19
- Target
  
  libGLESv2.dll
- Size
  
  7.4MB
- MD5
  
  88d60bc6f44a787eecd81a4ac48b5303
- SHA1
  
  24780d51c16b79666eef7a236808e3c057d6d451
- SHA256
  
  adf1691ed16e29580174ace664410465703a4949fbb729b7037b869fece7134b
- SHA512
  
  156b013c25af9a6051528a4e69f0763c38c2122f3e1c97dbf84a8e464693abcd1d87f0e7f3da513a72218b1c75ac4528bfeaf707b6ae9c2299ff4a4a1f045e19
- SSDEEP
  
  98304:EoM1bKXyhXV3XI9f1OW7BheoI1Ty6sDCpsXm3T:Eb1TlXIH77iTHWCT
Score

1^/10
behavioral20 behavioral21
- Target
  
  locales/am.pak
- Size
  
  756KB
- MD5
  
  4eaa15771058480f5c574730c6bf4090
- SHA1
  
  2b0322aae5a0927935062ea89bd8bd129fa77961
- SHA256
  
  b05dcb8136751aee5eced680a5bad935e386bfce657dd283d3ec00ee722fd740
- SHA512
  
  b67e7dd24eadc91d4cd920f8864cfb23a9c67b2cecd54ec97e01705636604ce504dc417d6af1c53f374b58eddf71a12bb82248bd8fd68307161d4833342681a9
- SSDEEP
  
  12288:sjsuGn8MVs2TZIuHzLzxBT2qE36jpECuzA+5P9LlVrClOwPQVx30jH8+F:HnG2TZVLzxwqEqjpECuzA+5P9LlVrClj
Score

1^/10
behavioral22 behavioral23
- Target
  
  locales/en-GB.pak
- Size
  
  424KB
- MD5
  
  a1aa885be976f3c27a413389ea88f05f
- SHA1
  
  4c7940540d81bee00e68883f0e141c1473020297
- SHA256
  
  4e4d71f24f5eea6892b961fcda014fc74914c1340366f9c62f0535e9b94ae846
- SHA512
  
  8b6d67e09fbe7a2152a71532a82c1e301d56cdde34b83a9f17d9f471e258b255d5b2d4a0c39f38581da3a31cec24fb403156a8e493560d7206e1ec3db7e68b72
- SSDEEP
  
  6144:heMA5+ocjYbYMP9ejI/AfaYzyJyC5+S6Bc0RIIf:kMhoxYMEI/+I5+Smf
Score

3^/10
behavioral24 behavioral25
- Target
  
  locales/en-US.pak
- Size
  
  428KB
- MD5
  
  809b600d2ee9e32b0b9b586a74683e39
- SHA1
  
  99d670c66d1f4d17a636f6d4edc54ad82f551e53
- SHA256
  
  0db4f65e527553b9e7bee395f774cc9447971bf0b86d1728856b6c15b88207bb
- SHA512
  
  9dfbe9fe0cfa3fcb5ce215ad8ab98e042760f4c1ff6247a6a32b18dd12617fc033a3bbf0a4667321a46a372fc26090e4d67581eaab615bf73cc96cb90e194431
- SSDEEP
  
  6144:5GdVxPtFXqVtOMP9eXe9HfaYvaVP51SLngF/cjjwB:yVpwOMge9B251SXjwB
Score

3^/10
behavioral26 behavioral27
- Target
  
  locales/es-419.pak
- Size
  
  515KB
- MD5
  
  5abcb35738fcb4217888925eaa8f943b
- SHA1
  
  a195fb95343d2fad6ec79a80efc848497f2b0083
- SHA256
  
  51ff321a6612d56daabc7874ec306680f610c391ff4392c61a59d3ac2a3380b5
- SHA512
  
  1272ddc6310fa9135e327111c6426fff39187df07d770b9fb366d6a87922e5ee1dd81cc676b17f8ed6370b786badf92c850910674ef5dadcef3bc7987ea62d3c
- SSDEEP
  
  3072:Ln1o/wiAUJHOkNejz28CU1g6Cjnp4EcO37Su8pnYl4lbjK2oE1AozsoLhWRR5BXF:LnAwlsejlHDXzpnY8KJ5BXmLFmQIzL5
Score

3^/10
behavioral28 behavioral29
- Target
  
  locales/es.pak
- Size
  
  515KB
- MD5
  
  31936c5b039863804c46145a27fc615d
- SHA1
  
  0d20953ab0ed681e7b7f44b5b75cceecb849f4a4
- SHA256
  
  d2f4bc89eae5bf98de0babc85f63ff9f801fbe388ad6534adb3582e5e0d320f8
- SHA512
  
  66e15c3585eee7bf5a8e7a7e796718e1a525155d12e9264798e52fbaebb5a8d83387a01ac831dd0eb570d5e5f559dd8d3de1b2b2d340ce22bec15c695ceaf052
- SSDEEP
  
  6144:BgWRhMjtN7/v919Muk5ugT4/pu+Aiw10hUnjB5Vrr5JQMo6PZ1Cu:BgguPL9zkLspbw10WnjB5VrfQgL
Score

3^/10
behavioral30 behavioral31
- Target
  
  locales/et.pak
- Size
  
  468KB
- MD5
  
  e7ea23d6304d5d600d884f4e3b3cb2d7
- SHA1
  
  99fbef7eb1bde7df398cce9faf6c7c357769334a
- SHA256
  
  292eb18ec61502b0e952b447f73a66143c56dd95f170981945e5aab53a6b32b3
- SHA512
  
  23dfa1161d11faf440241b1f48f2ddbc8ec086a8e18da351734656551f0f54fe4c94b490c0d3ecc378a3de7f7713a1626a7a6c21da2500b9597b44fd08197d50
- SSDEEP
  
  6144:5oD1EPHeXyxhmokCJ1HNRSnQp+LNmW7Fb0cmFotp43rPYJpiT/d25hjm43LPvCKt:5i1vokAwQ8FFmFotm25hjLx
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Epsilon Stealer

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32