0146aca5c73ba4135d9605e8750e8cbd77a74bb5d607e7f3b304014df51de121

Sharing

Copy URL

Twitter E-mail

General

Target

epsilon.exe
Size

84.1MB
Sample

240522-a4m38sfa84
MD5

7a7030c77b6cb44df2f1fc9a5f236f32
SHA1

4774dcfd7ec039149a100069313c0a9493386b93
SHA256

0146aca5c73ba4135d9605e8750e8cbd77a74bb5d607e7f3b304014df51de121
SHA512

066e68322e45d2119740d2db80394fa21bed865a10336bb59644b662faac6ea7321f7ca28845cde3c28d338de99cfa04d23738d69f775dd7877e0d09c02d8b6f
SSDEEP

1572864:A4gPXMoWaro1VBdQ2kZ2eoI3t9vROpiwiODQzqwM7HvtdNZJ2HLjfocdxMH7:A4AcorOBdMZ2eN3LvR+DDQWwM7HNIHJm

Score

7^/10

Malware Config

Targets

- Target
  
  epsilon.exe
- Size
  
  84.1MB
- MD5
  
  7a7030c77b6cb44df2f1fc9a5f236f32
- SHA1
  
  4774dcfd7ec039149a100069313c0a9493386b93
- SHA256
  
  0146aca5c73ba4135d9605e8750e8cbd77a74bb5d607e7f3b304014df51de121
- SHA512
  
  066e68322e45d2119740d2db80394fa21bed865a10336bb59644b662faac6ea7321f7ca28845cde3c28d338de99cfa04d23738d69f775dd7877e0d09c02d8b6f
- SSDEEP
  
  1572864:A4gPXMoWaro1VBdQ2kZ2eoI3t9vROpiwiODQzqwM7HvtdNZJ2HLjfocdxMH7:A4AcorOBdMZ2eN3LvR+DDQWwM7HNIHJm
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral3
- Target
  
  LICENSES.chromium.html
- Size
  
  8.8MB
- MD5
  
  2675b30d524b6c79b6cee41af86fc619
- SHA1
  
  407716c1bb83c211bcb51efbbcb6bf2ef1664e5b
- SHA256
  
  6a717038f81271f62318212f00b1a2173b9cb0cc435f984710ac8355eb409081
- SHA512
  
  3214341da8bf3347a6874535bb0ff8d059ee604e779491780f2b29172f9963e23acbe3c534d888f7a3b99274f46d0628962e1e72a5d3fc6f18ca2b62343df485
- SSDEEP
  
  24576:cpD6826x5kSWSsRinoHnmfm646a6N6z68SH4SApTJ:cHSek
Score

1^/10
behavioral4
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral5
- Target
  
  discordapp.exe
- Size
  
  164.7MB
- MD5
  
  f2d0574cabbc53fa49a48ea393bc0e08
- SHA1
  
  559efe7cae86f5eeb78e6e49875d25a5caeedb3c
- SHA256
  
  f660ed4f629400fcea51c34686858c1268a4aad6dbc6c75485116bdf3ff734da
- SHA512
  
  8d1315d3bb1fb6faa54c292bd4b79d6835d73ed10c82330ba5f98a13b6f2ae9d33c5058bb30768f1cb187371ba76d989a8eac371463d79427bdbee63a4a15134
- SSDEEP
  
  1572864:htRb5j0Jo3k4uaSwrkaxMnHo/qVfZanrCfYbmLlEkwPT15+ztDTeNokbaGMZAHmM:hTlBaHTf7x+Un
Score

7^/10
- Loads dropped DLL
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral6
- Target
  
  ffmpeg.dll
- Size
  
  2.8MB
- MD5
  
  cc00135fe47c2e1e3c2afdae364e343e
- SHA1
  
  b6f2edebeae328004537147e4743523f1eba88fe
- SHA256
  
  5dad57ea08d8af1e78889e7b9191a0d4cb55e6124a447a8ab352064ca20a200d
- SHA512
  
  cbd7392ffb932241eaa3d67e4df7e2fa1163529e46ecf7ed17eb80fe5f36895ed00b39feccbb9966cfaebafba83b576a4f9a17593bb2bb61d8df70703d90b35f
- SSDEEP
  
  49152:HF5qb84KtStWEK/Ju2lf3tAtiLHQVTf6yfcrhCHDXLl8+0LKSQdSCu:HFvSkJXv+tiLAD0+DdS5
Score

1^/10
behavioral7
- Target
  
  libEGL.dll
- Size
  
  477KB
- MD5
  
  15122a10e56ba77fad6f9de0498bdc23
- SHA1
  
  fe9dd8a2300155c8e1793fd91049cebda914f80f
- SHA256
  
  9d3bda43e5a5cecbed08429cd282bebf99934622a2790e714d95cd0228040c24
- SHA512
  
  0bd4ee0e047068e932e74e55c810debf07c8f7099f08f3ed16496efe7070521db240d03b73ae7e0f6c04e9ea1142abd1391e1cf17a9d4dd6296c30e75767c120
- SSDEEP
  
  6144:J8hd1BSjuMmof2SEXVVfgV8hxN7h2NeIEOg51f0FticyQ:J8DXSjZmof2SEsmN12NeIE7f0FticyQ
Score

1^/10
behavioral8
- Target
  
  libGLESv2.dll
- Size
  
  7.3MB
- MD5
  
  76693ad1c75cdc538f5e5578ede80cbc
- SHA1
  
  5317ad99f6a70a582b38cb9f8b25547ce5870a8c
- SHA256
  
  ab22f3d242aacd5ad30cb95f95e7091aa72416a68f51d5fa4cd78c3727b0be59
- SHA512
  
  76cd3e8cd04db7ed49022c5bd37f378ae05c9b8c9a767be0a6cb3cd81c0cd6d7a6717f51e0f8d3b6e918a9ed1d454099d6dcce26c5b83621426a27346e8c5796
- SSDEEP
  
  98304:+wY1sQqaLe2Egto8U4r5Pp6TlITQZ3eW888888888tb8dOi:dNaSgtvroZe
Score

1^/10
behavioral9
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral10
- Target
  
  vk_swiftshader.dll
- Size
  
  4.9MB
- MD5
  
  1f310037e6369da31d700dbd8fee0ac2
- SHA1
  
  dc101393382996c2079815a6911bc780cebb0bb7
- SHA256
  
  7488ef4036c46d4ef85c65efbc83617478a6401dbc00e94ec953fe46f0307857
- SHA512
  
  09195184484e78a2c70495142a96a9eac4dde7fbed32042b8fb6961ac288a8ffa3049823d30958b5e0fb0ab321107e7ee2d78eb49ed3808070c6c75038fcaf29
- SSDEEP
  
  49152:36h3a0f1ABi1jP9LoS8lne0Zv8EgHI7JXYN3bgFNmEgMYmz2qA0Mr7wsVUsNCOzy:Kh3aMXoSHfPwksHldLiuNr
Score

1^/10
behavioral11
- Target
  
  vulkan-1.dll
- Size
  
  931KB
- MD5
  
  a6d04cab54d4bcb377939fbdf7b31e34
- SHA1
  
  e082c247e06a0724702ecc0d97082cb7b6af13bf
- SHA256
  
  a30dee992d32d160d2eb55ed5c1320b5017b945c2aece5d0b26489d31b297599
- SHA512
  
  2330530c5135a71a67e688eed4498545995b233a5eb142912ccba563f596f789be716e65845c28712785e90d33715c0c16be3bd397585e1614d5593130aed078
- SSDEEP
  
  24576:TYWOq/4Kt/Ku8n387ecbFb6Z5WoDYsHY6g3P0zAk7sx:TY65/M387R56Z5WoDYsHY6g3P0zAk7s
Score

1^/10
behavioral12
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral13

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Loads dropped DLL

Looks up external IP address via web service

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13