General
-
Target
EulenLoader.exe
-
Size
17.7MB
-
Sample
240603-lk9zfabe69
-
MD5
1611d81328b8108b6c9a598284c7fde4
-
SHA1
c6127a706211414ac129cbabab04a4778cd551b9
-
SHA256
f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7
-
SHA512
39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a
-
SSDEEP
196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5
Static task
static1
Behavioral task
behavioral1
Sample
EulenLoader.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
EulenLoader.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
EulenLoader.exe
-
Size
17.7MB
-
MD5
1611d81328b8108b6c9a598284c7fde4
-
SHA1
c6127a706211414ac129cbabab04a4778cd551b9
-
SHA256
f2c3754b6b7a050d9da9b319a724728116bc547d72c6c4be3092fb8b351f50d7
-
SHA512
39f629965a4c13463b06c44729f661dcddf48c9eceaddd920d5f75b545594eca7977203171b869462e6a97cbb57156c0cd177f361a776a5055775f0ecb0d5f8a
-
SSDEEP
196608:JhxxXll6qNbuDyHWbTNgSH1jkpICTvykr:JhxxzzbEy2/pkp5
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1