epsilon | b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532 | Triage

Resubmissions

21-03-2024 20:39

240321-zfcp2abe6y 10

21-03-2024 06:57

240321-hrb47sea62 10

21-03-2024 02:45

240321-c88a3sab35 10

Sharing

General

Target

b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532.exe
Size

81.5MB
Sample

240321-hrb47sea62
MD5

5dd59267ecef10c7e9dc091c77ea6b66
SHA1

82c999fc2c4c071f219506460a84be21bcce0356
SHA256

b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532
SHA512

1772263730f9f057cac0aa5c9bc5b3a1b4237c06c13d313ebc5acc0852c4490e9757be295b0d62d3eef16c1cf5d650624fb65aaceeb5ffbf6bee15cd7ee7fe9b
SSDEEP

1572864:Zqu7pKBpn7Qr7WCftm4Vm72X/teWdJDwT3PrvDVTr88:ZqK0UrhfA72PtvtQ3DZT48

Score

10^/10

epsilon persistence spyware stealer

Malware Config

Targets

- Target
  
  b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532.exe
- Size
  
  81.5MB
- MD5
  
  5dd59267ecef10c7e9dc091c77ea6b66
- SHA1
  
  82c999fc2c4c071f219506460a84be21bcce0356
- SHA256
  
  b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532
- SHA512
  
  1772263730f9f057cac0aa5c9bc5b3a1b4237c06c13d313ebc5acc0852c4490e9757be295b0d62d3eef16c1cf5d650624fb65aaceeb5ffbf6bee15cd7ee7fe9b
- SSDEEP
  
  1572864:Zqu7pKBpn7Qr7WCftm4Vm72X/teWdJDwT3PrvDVTr88:ZqK0UrhfA72PtvtQ3DZT48
Score

10^/10

epsilon persistence spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Process Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

epsilonpersistencespywarestealer

behavioral3

epsilonpersistencespywarestealer

behavioral4