epsilon | 8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506

General

Target
8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506.exe
Size 81.5MB
Sample240322-1tr8baca3v
SHA256 8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506
MD5 9a7871e4a4d97bd0843c03413d92fd65
SHA1 80cba1b157a43b9c9fd3fe500f2f8b3acf89a023
SHA512 4ed36eb531c98e4bb4137b5d94b24c8e5804228c614d59147c9d0d28c2f0398b0a08a757fd873621a01e3e74ba30c9bae6c36202e480e5bb4280793b2c4efeaa
SSDEEP 1572864:Yqu78D7epWriSNcfEXk+R8W7Vb8Rfw9QbsGQJB9pepBifT8:Yqf748heiR8KVbufw9Y024T8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506.exe
- Size 81.5MB
- SHA256 8863f887505fb33aa29b652cb3f84999c63da172d917b96ea7958a869d508506
- MD5 9a7871e4a4d97bd0843c03413d92fd65
- SHA1 80cba1b157a43b9c9fd3fe500f2f8b3acf89a023
- SHA512 4ed36eb531c98e4bb4137b5d94b24c8e5804228c614d59147c9d0d28c2f0398b0a08a757fd873621a01e3e74ba30c9bae6c36202e480e5bb4280793b2c4efeaa
- SSDEEP 1572864:Yqu78D7epWriSNcfEXk+R8W7Vb8Rfw9QbsGQJB9pepBifT8:Yqf748heiR8KVbufw9Y024T8
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

epsilon persistence spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  azkzkzz.exe
- Size 168.4MB
- SHA256 a04e61c7d07593d8cd0981f1a209790df34a06ce2f6b8b1c3056da501a08734c
- MD5 5417c504368499446bdec5db1fc32084
- SHA1 06f065023d2c7feb3b0d06165e71e90e5bb6f3f1
- SHA512 ebf0ff91a80c5658b361a08511df95ae4356cf34d58721473c534cee889e2875687ffd5109b9b6a6d8932c1b7ff42ba2f3eaf1365b6d75036f2f3c9a21cb04bd
- SSDEEP 1572864:OFMGWm9AKuVLWFivYPZ9eNo6pIaIPbDjK14DTbGWeUVXIHzzx9dbF5Zwa80aSesY:BGFWZoNaKDTopXz
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

epsilon spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4