General

  • Target

    EulenLoader.exe

  • Size

    17.7MB

  • Sample

    240603-lk9zfabe69

  • MD5

    1611d81328b8108b6c9a598284c7fde4

  • SHA1

    c6127a706211414ac129cbabab04a4778cd551b9

  • SHA256

    f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7

  • SHA512

    39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a

  • SSDEEP

    196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5

Malware Config

Targets

    • Target

      EulenLoader.exe

    • Size

      17.7MB

    • MD5

      1611d81328b8108b6c9a598284c7fde4

    • SHA1

      c6127a706211414ac129cbabab04a4778cd551b9

    • SHA256

      f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7

    • SHA512

      39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a

    • SSDEEP

      196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks