epsilon | e54d7b6b9f1cc61d59519d5cac352c798158f63f834b663a035198a1e6685a8b

Sharing

Copy URL

Twitter E-mail

General

Target

Relase.rar
Size

72.0MB
Sample

240302-yg89yshc32
MD5

3142504032a9ab1be4ddfd16535d08f5
SHA1

b223db11b5e75785838b8eb16811cc091c1d11ee
SHA256

e54d7b6b9f1cc61d59519d5cac352c798158f63f834b663a035198a1e6685a8b
SHA512

1c8078291978de2745671e7c37d8844df8e44ef49aa7d5b2904521a8beaf66b5c9d6ecefcd22ce74931ef8c39e8fd6b9d9102f564db54e81d216a36ddf155db7
SSDEEP

1572864:pejOS3t9sG1ZEuUfuVpWO9cC4LG8UzK+uxoG+YYfeGn+ynI8:p6pEWp0C4LGnsX+YYR+v8

Score

10^/10

Malware Config

Targets

- Target
  
  Relase.rar
- Size
  
  72.0MB
- MD5
  
  3142504032a9ab1be4ddfd16535d08f5
- SHA1
  
  b223db11b5e75785838b8eb16811cc091c1d11ee
- SHA256
  
  e54d7b6b9f1cc61d59519d5cac352c798158f63f834b663a035198a1e6685a8b
- SHA512
  
  1c8078291978de2745671e7c37d8844df8e44ef49aa7d5b2904521a8beaf66b5c9d6ecefcd22ce74931ef8c39e8fd6b9d9102f564db54e81d216a36ddf155db7
- SSDEEP
  
  1572864:pejOS3t9sG1ZEuUfuVpWO9cC4LG8UzK+uxoG+YYfeGn+ynI8:p6pEWp0C4LGnsX+YYR+v8
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  Launcher.exe
- Size
  
  72.0MB
- MD5
  
  57ed14a50cc4e6c2cb7b69a817f40bb9
- SHA1
  
  709121d06d6045a865750553159fc67200910a2a
- SHA256
  
  4b54f60af967be6de1674eccbedaff6dab038b8baa2a8735fb7e09e9a90e7a39
- SHA512
  
  0676764fb7d06a356f106f8d4f33609c3613ed8896cd94b26bc2775eec173db8e04010f9d5179c3089b47ba3aa0cf49a767fb7c7e58ae0e1143f8bcb63e6c4a6
- SSDEEP
  
  1572864:IejOS3t9sG1ZEuUfuVpWO9cC4LG8UzK+uxoG+YYfeGn+ynIN:I6pEWp0C4LGnsX+YYR+vN
Score

10^/10

epsilon spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/app-64.7z
- Size
  
  71.6MB
- MD5
  
  8b9938214f06556a961769d1e615e8ee
- SHA1
  
  4b7f77ac8d4a2b23d9dab31ce67c9245fab07daa
- SHA256
  
  725a964a789037a398c8184740afbdefe3d9d84b0f72c3a68575172ac15884a6
- SHA512
  
  0c97ceac75993f3f0fe1e672c2f99f4ce90eea5572421e96c5bb08032160dd07bb545c6bba271d8e4c5627194fc2b85736b7981134b7aae451ff596f6dd04522
- SSDEEP
  
  1572864:yejOS3t9sG1ZEuUfuVpWO9cC4LG8UzK+uxoG+YYfeGn+ynO:y6pEWp0C4LGnsX+YYR+Z
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral10 behavioral9
- Target
  
  LICENSE.electron.txt
- Size
  
  1KB
- MD5
  
  4d42118d35941e0f664dddbd83f633c5
- SHA1
  
  2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA256
  
  5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- SHA512
  
  3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
Score

1^/10
behavioral11 behavioral12
- Target
  
  chrome_100_percent.pak
- Size
  
  163KB
- MD5
  
  4fc6564b727baa5fecf6bf3f6116cc64
- SHA1
  
  6ced7b16dc1abe862820dfe25f4fe7ead1d3f518
- SHA256
  
  b7805392bfce11118165e3a4e747ac0ca515e4e0ceadab356d685575f6aa45fb
- SHA512
  
  fa7eab7c9b67208bd076b2cbda575b5cc16a81f59cc9bba9512a0e85af97e2f3adebc543d0d847d348d513b9c7e8bef375ab2fef662387d87c82b296d76dffa2
- SSDEEP
  
  3072:IOzwJCGIekwdLpsXYFAXg6IL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:IOzw1Iekam5QpK18Gb0OV8ld0GecQ3Ey
Score

3^/10
behavioral13 behavioral14
- Target
  
  chrome_200_percent.pak
- Size
  
  222KB
- MD5
  
  47668ac5038e68a565e0a9243df3c9e5
- SHA1
  
  38408f73501162d96757a72c63e41e78541c8e8e
- SHA256
  
  fac820a98b746a04ce14ec40c7268d6a58819133972b538f9720a5363c862e32
- SHA512
  
  5412041c923057ff320aba09674b309b7fd71ede7e467f47df54f92b7c124e3040914d6b8083272ef9f985eef1626eaf4606b17a3cae97cfe507fb74bc6f0f89
- SSDEEP
  
  6144:QsDQYaSN6svydHLhQegx5GMRejnbdZnVE6YoppO4:QBfSN6svydrx6edhVELoXO4
Score

3^/10
behavioral15 behavioral16
- Target
  
  icudtl.dat
- Size
  
  10.2MB
- MD5
  
  e0f1ad85c0933ecce2e003a2c59ae726
- SHA1
  
  a8539fc5a233558edfa264a34f7af6187c3f0d4f
- SHA256
  
  f5170aa2b388d23bebf98784dd488a9bcb741470384a6a9a8d7a2638d768defb
- SHA512
  
  714ed5ae44dfa4812081b8de42401197c235a4fa05206597f4c7b4170dd37e8360cc75d176399b735c9aec200f5b7d5c81c07b9ab58cbca8dc08861c6814fb28
- SSDEEP
  
  196608:hpgPBhORiuQwCliXUxbblHa93Whli6Z86WOH:n8wkDliXUxbblHa93Whli6Z8I
Score

3^/10
behavioral17 behavioral18
- Target
  
  locales/af.pak
- Size
  
  464KB
- MD5
  
  862a2262d0e36414abbae1d9df0c7335
- SHA1
  
  605438a96645b9771a6550a649cddbb216a3a5b1
- SHA256
  
  57670eae6d1871e648ad6148125ee82d08575bec5b323459fc14c3831570774a
- SHA512
  
  a789a4cad72106a5c64d27709b129c4ae6284076f147b7c3fcb808b557a3468b4efe3ede28033f981335d5eab986532c0497ddd6ed24b76189fe49366692ee73
- SSDEEP
  
  12288:KYHoLheVm/Wnzo+E+VOSMKlNu+d2ZH2Jynua2VIzfXo0vIFNgRU2Sw+2Ss37xzOZ:LoL0Vm/Wnzob+wSMag+d2ZH2Jynua2V5
Score

3^/10
behavioral19 behavioral20
- Target
  
  locales/ar.pak
- Size
  
  829KB
- MD5
  
  a7c00155a208816cf40b534856f2c5ff
- SHA1
  
  de423dd50b1cfb4c4981c567d9d2d0d7344c149c
- SHA256
  
  c931a2aba3341ca32b8fe9cb0cf9ed109ac6aa7bdb2368c465c3f8e2c25d94de
- SHA512
  
  554ac18de640b583422e2d3c20e247491fe738b1c24647e078abc96c24742ecf1d8f0f38260827152972c625cf36e86d6f6d35a92bbef47eb0c3645f7690686d
- SSDEEP
  
  12288:whjQkIIXkBukM/T/RJGX4Yxwv4UPCNakER5XN01++QIYkpT:gjfvv9x5u++
Score

3^/10
behavioral21 behavioral22
- Target
  
  locales/bg.pak
- Size
  
  861KB
- MD5
  
  0e8005b17ac49f50fb60f116f822840d
- SHA1
  
  f2486da277de22e5741356f8e73e60b7a7492510
- SHA256
  
  50e4f6b9c387adf4baba3377c61d99326cc3987928d8d60b88d1ac29352820ea
- SHA512
  
  5df18bbeabd56e70d4c5a80dee5b7ce48259000665941634937e556e3b3a1c6403aa45c410f6f755607549c9dd35d722987b447c50efca51228ffeca4628756d
- SSDEEP
  
  24576:9MCo3qBsklYOdAs1axUYVbOAHi373Z5+3aAK5kVDV5uRumpod2JK5ITOuORx6QKq:9MCo3qBsklY/UYVbOAHi373Z83a1kVDj
Score

3^/10
behavioral23 behavioral24
- Target
  
  locales/bn.pak
- Size
  
  1.1MB
- MD5
  
  c8173f0cc63ca9e02c07abec94892b53
- SHA1
  
  2688b199cc40bb2082247fa451eac1304608e48b
- SHA256
  
  e6adcfb4f3b3bccd4a27edadc168b503c36551cd6b27fb24043efeb21f691ce5
- SHA512
  
  3d2317430722dc15c5d938fa55235af1caa03dcff7a574b44d37d89e7cf2c94dd2e84518b3eeca4a5a8dbec1b99d94aed97429aaf55c63998002d50ce9cb5019
- SSDEEP
  
  3072:HPvKTlIymMTAKhwg8KgMokBw20kzhY0/ukfe0/Q8hhar6j7dkjBbJrlD+B5rwDlo:HPvtMTAKhwlFpKAShhG6j7wBb85mlo
Score

3^/10
behavioral25 behavioral26
- Target
  
  locales/ca.pak
- Size
  
  524KB
- MD5
  
  a96207d66f2a66bd9716a80ccaeb6106
- SHA1
  
  e7fe4a3cf0d681eb9fc6aa8707bda5e41d0be9d0
- SHA256
  
  61c1c2a1aad4d38538ac51f8dff57f3319baa9c5287ea5113ae6fc486cf8af3e
- SHA512
  
  c03b97c29ad57f54d3cfdcc3ae0e22e0042bbb792f442dc6ae3f29d202e7afdabf6b2f17925a5944fbb1b39da4f0ae181c5bc14e175ae2b3cb8499b318cad15b
- SSDEEP
  
  12288:BLUzxDVtg7kREeopxA3n5PqF4N3Mw2juwHzejm0t3lvq8+x9sfR+IsjcmlLEYjCa:2zxDVRY6vR6QZIMN7vsyL5fGjiu
Score

3^/10
behavioral27 behavioral28
- Target
  
  locales/cs.pak
- Size
  
  539KB
- MD5
  
  70f320d38d249b48091786bd81343afc
- SHA1
  
  367decdcdad33369250af741b45bdc2ca3b41ab3
- SHA256
  
  1c9448ea3aefce1a7e1491e73af91af772d8b22d538676a2beab690558e668fa
- SHA512
  
  02b08ed9261fd021e367995551defaf4b4f54c357409a362f4d2470423644913375cac444f62153ec2963a84880a30a36f827dbfacdd76a6222838c276cf5082
- SSDEEP
  
  6144:Lg4k2oNIYl8pvlntLO2A8YfZA2WBe5rK8VuvNO4w3SBZmPyO8QP:Lposty2A82IBe5rK8VuvNO93SrmPP
Score

3^/10
behavioral29 behavioral30
- Target
  
  locales/da.pak
- Size
  
  487KB
- MD5
  
  426c1035169c079400d71e700cb7aa12
- SHA1
  
  90fd4c7c1ec66cf7a4fbf528b0522c3670c5a99f
- SHA256
  
  bbd28bfcfb94631347d4aa0ce0a0a756b7003fc486dc3360e0e7ecfc8fe1ee63
- SHA512
  
  5290cd34d7022ad6048dae6e02f5c793cde949187cd5527c090be7818a2f2eb71602ee3ceb184a6abef325bfd33ef72ea582a85ab989c2efaad10eadebebaee3
- SSDEEP
  
  6144:ZZchZvfVKzV0sN5cvfAe914eA4owlTamJw/zobqU9aFut55Prms+zd4bTGqewc:ZZchn4yAN4aHK5xrXTpM
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Epsilon Stealer

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32