epsilon | 9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5

Sharing

Copy URL

Twitter E-mail

General

Target

SecuriteInfo.com.Win32.Evo-gen.30889.28387.exe
Size

67.0MB
Sample

240411-kggytaah4w
MD5

807f4058831c664d137f1c19d69379e6
SHA1

215f517c3c5c6e1cc1bb30b5d5aa56d3b9801b5b
SHA256

9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5
SHA512

199feb5a6576965b42e18c718a98a58be39547282cb908bdc46355ac92da27b6b9c76a86f206229556e4e4be890b66e6aa0d3b0eb3c3830d72d4799064a64bd8
SSDEEP

1572864:5KYbpVQhTWVMrqLbuc1h6ZC0C7Ra/+W+upGRGyS5LBrGHiQU8:NOhTWVMuL1k7cRa/GoyS5tsiH8

Score

10^/10

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Win32.Evo-gen.30889.28387.exe
- Size
  
  67.0MB
- MD5
  
  807f4058831c664d137f1c19d69379e6
- SHA1
  
  215f517c3c5c6e1cc1bb30b5d5aa56d3b9801b5b
- SHA256
  
  9c1a052b4f6fbbe3c6437b3af2a3f93f2218b3c175073e7daeb6361f999a94c5
- SHA512
  
  199feb5a6576965b42e18c718a98a58be39547282cb908bdc46355ac92da27b6b9c76a86f206229556e4e4be890b66e6aa0d3b0eb3c3830d72d4799064a64bd8
- SSDEEP
  
  1572864:5KYbpVQhTWVMrqLbuc1h6ZC0C7Ra/+W+upGRGyS5LBrGHiQU8:NOhTWVMuL1k7cRa/GoyS5tsiH8
Score

9^/10

evasion spyware stealer
- Enumerates VirtualBox registry keys
  evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral5 behavioral6
- Target
  
  Ghostbane.exe
- Size
  
  133.4MB
- MD5
  
  21dcf914458e92f92928d52bd89470bf
- SHA1
  
  cfe743e325859af219cc91b3e375b9afed58a6a9
- SHA256
  
  c68227296b243230fa9cb2fc7a1d3eed54de34db04bf0a8fb6b7c04c77bf44c5
- SHA512
  
  c8ccfd2cbc84b227c89e95988c51ddec76d99dd7cb06460c01c999bbe65018cd51422d9a03efa327d7e31723e0745658e47da54950959ef4e4d8d8cc9e22272c
- SSDEEP
  
  1572864:42HVo9Ck+yOBBdJAVwlymAETslfp409t:G9Ctx3tu
Score

10^/10

epsilon evasion persistence spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Enumerates VirtualBox registry keys
  evasion
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Looks for VirtualBox Guest Additions in registry
  evasion
- Looks for VMWare Tools registry key
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8
- Target
  
  LICENSES.chromium.html
- Size
  
  5.2MB
- MD5
  
  4247afa6679602da138e41886bcf27da
- SHA1
  
  3bb8c83dc9d5592119675e67595b294211ddbf6e
- SHA256
  
  bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
- SHA512
  
  ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
- SSDEEP
  
  12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
Score

1^/10
behavioral10 behavioral9
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.3MB
- MD5
  
  7641e39b7da4077084d2afe7c31032e0
- SHA1
  
  2256644f69435ff2fee76deb04d918083960d1eb
- SHA256
  
  44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- SHA512
  
  8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP
  
  49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
Score

1^/10
behavioral11
- Target
  
  ffmpeg.dll
- Size
  
  2.6MB
- MD5
  
  7977f3720aa86e0ec2ad2de44ad42004
- SHA1
  
  04a4ef5ccd72aa5d050cc606a7597a3b388c6400
- SHA256
  
  61c6bd5fee2c150265241a15379c4053b174b1cd7687749629afcdbd1264a02e
- SHA512
  
  8ef3b8f506b5ad7241b96d381a501033266358fb3756a457c46ed499547db1232012f849838e65f916129fab1a0d74711e9851b8e0669831acbbf4c3494e492d
- SSDEEP
  
  49152:baOoZks54czfQNk9GSQABmZuZgAp1iJxgG1broIhj4OxSZpSq:it59uEBm8geZz
Score

1^/10
behavioral12 behavioral13
- Target
  
  libEGL.dll
- Size
  
  431KB
- MD5
  
  7b77074945dfe5cf0b1c5a3748058d57
- SHA1
  
  fdea507ac2be491b8ad24ddc1030ea9980c94c0d
- SHA256
  
  994972c1bc515c199552d50e97ad217ae15a3eed16db06181c7df50e743e8a56
- SHA512
  
  d637b2c7d75723601af099317a39820d3edbd3cea1e1cb20b702deb6ca7fdb0b67e1351cc8fee1c7badff957fffb848a8dce18bb25bfd60c81a588da4f68c1fd
- SSDEEP
  
  6144:QpKolEK3EyQVAZvhnzGtMY+3lnLdYcUpwOXW4IUo+lTsRLVDc2/:QBl1EyyAZvJWM936wOJTWVDc
Score

1^/10
behavioral14 behavioral15
- Target
  
  libGLESv2.dll
- Size
  
  7.6MB
- MD5
  
  8c93e19281992a00993fc0f09e272917
- SHA1
  
  3a2d12bc85f829775ec8c5c1f8e35a783d37b7a7
- SHA256
  
  1ebc1da8d7e463a5d3dc127a632989ef35cfbd94cb18bf1f8ee790f172d43703
- SHA512
  
  c4ec65378d83e6645c9128825853de2d3e82c0f430cd28fdc761eaf2d011267c3794b7c1dcef017750323873d7fe976656eebf9ed7c03582741d43738f3e0c7c
- SSDEEP
  
  49152:BIgJiNu/CVyS4I+K/UGG7ftgIj4RBrGW+T54vwjKxH33yjsMfRJvLnLBXonnMl9W:mNyUxGDahRNR6gyxQi4Mn0YJ4/qamG
Score

1^/10
behavioral16 behavioral17
- Target
  
  resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
- Size
  
  3KB
- MD5
  
  d226502c9bf2ae0a7f029bd7930be88e
- SHA1
  
  6be773fb30c7693b338f7c911b253e4f430c2f9b
- SHA256
  
  77a3965315946a325ddcf0709d927ba72aa47f889976cbccf567c76cc545159f
- SHA512
  
  93f3d885dad1540b1f721894209cb7f164f0f6f92857d713438e0ce685fc5ee1fc94eb27296462cdeede49b30af8bf089a1fc2a34f8577479645d556aaac2f8e
Score

1^/10
behavioral18 behavioral19
- Target
  
  resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
- Size
  
  13KB
- MD5
  
  da0f40d84d72ae3e9324ad9a040a2e58
- SHA1
  
  4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
- SHA256
  
  818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
- SHA512
  
  30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9
- SSDEEP
  
  384:4cr8sEcBeIXxqXhQsBxf5oBLBfXQM8ybCpGW1KTM+:4KEcRQBTxWlPZxWpG+Qx
Score

7^/10
- Executes dropped EXE
behavioral20 behavioral21
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral22 behavioral23
- Target
  
  swiftshader/libEGL.dll
- Size
  
  445KB
- MD5
  
  be1b6fe26a1b5a3e1302c26ce5ce53f3
- SHA1
  
  c3cac08e89c4cc91eae1cc87e33a1dea723f1d78
- SHA256
  
  162abe61314e720384d8cdd43190a89df8a96de52f3ede7b6c58998f615d8546
- SHA512
  
  07dca111391dfb6b7e90d4be02071bc625128eeca0b9d9a3cebdc7916baec9f95cbbf906f2533befd6b62b9bbc69488ffa720f8d40c9710dd3b7d540d9dcaa55
- SSDEEP
  
  6144:NldwaUBIAHXboKn7YsGfJjjvQppfSH6RdW8wrpGLVgf8q:JWIsXboKnMAfSHChgUq
Score

1^/10
behavioral24 behavioral25
- Target
  
  swiftshader/libGLESv2.dll
- Size
  
  3.0MB
- MD5
  
  1e401ccda5b723ab8a595a54f7d2531c
- SHA1
  
  127716680dd16f776b19c2306d716935e54c5100
- SHA256
  
  c167a458174e2a280c39d7af31bd109e8e2921032a687097b584653adc33ab21
- SHA512
  
  1f2f35021f338aa7c5a0ae83c196217fbca6b1d017ac1bb4f1eebb93bd6e18c5d74c1a14bd4899d7a91d054b0139b2c4fc3271c35148ad1d8b71139aff0132fc
- SSDEEP
  
  49152:8NF/tcKnjh4NDNR32u7X5f2yRwT6mcavJ9BtCCp5kVtjjFCo5Z5UbNyJzSZ85C5c:8NIaqrNONEniz7P
Score

1^/10
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  4.3MB
- MD5
  
  77f7b4f46cb3e06b53729fd1e562dfef
- SHA1
  
  223c09805220ff2b5c1dcbdd5c0396231ea34f11
- SHA256
  
  a648cd4671b12b469c4d2de20c2ba2429c9388c0f9d4b3d9d2244853d0e5acb5
- SHA512
  
  6be9afda9320074c5842419cf8493d715ca65a3362d368d3a35e35a47d36f8197b0f19877485b41a06e21148613a77bb6275b0586c4a38da8a25efe6b5a6b571
- SSDEEP
  
  49152:ImuXbIxohwCWtm32rw3lYIDkhUw2B2w/XBnbtZNDNHI6iBewVqlnrSrMrXHYtvQi:Ca9dCeKOB
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  715KB
- MD5
  
  25afbdf6701013c57b19b92225920915
- SHA1
  
  009300dd4ab3b81794388ce7d126ae90ff97535f
- SHA256
  
  22bb65dd206ce7ee10c05557933a04a04144e1a8228d2a9d1e9d704b0b1b2f7c
- SHA512
  
  575e38b60948cb704c355ba9cf3457f2693c30f95e85f10f795e759652bf4317e18ba480bee8aafcea9108415e8e58f674b22c7513a9fabee765142486919a0e
- SSDEEP
  
  12288:oYa8yQ628GMAhXhpt1o9Sc4irKabLqYz/oD4C56:ZgQ6jHAhx71o9WirKaqYDa
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Epsilon Stealer

Enumerates VirtualBox registry keys

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Looks for VirtualBox Guest Additions in registry

Looks for VMWare Tools registry key

Checks BIOS information in registry

Checks computer location settings

Identifies Wine through registry keys

Loads dropped DLL

Reads user/profile data of web browsers

Adds Run key to start application

Looks up external IP address via web service

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32