Electric.rar
- SHA256 d5b29e1a098411e40406bcea0640e75fc04e74877d5e946cda1b63bfc2b15f4d
Behavioral task
behavioral1
Sample
Electric.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Electric.rar
- Size 24.0MB
- Sample240607-dsdxzagg8w
- SHA256 d5b29e1a098411e40406bcea0640e75fc04e74877d5e946cda1b63bfc2b15f4d
- MD5 15e10d350ac49cfd6d7e1812c16a626b
- SHA1 4114ebdedca2c128839cfbec416dc307d8509513
- SHA512 fa6afc60e4d9bf427cacc98b261065188e193b0178aba873aa1c367a5e72026fa8f91947746fc0b91031c86135490436ec7f626f2a60396eeff589eda276c33d
- SSDEEP 393216:EqEEvtoLgCwRUGzPCgTWQafjxjuDInObhIJJMFWRftG8AiVJwgoj++:EoCLvGzPC0WQWIDInwIJJM4lFTp+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Empyrean stealer 1 IoCs
resource yara_rule static1/unpack002/main.pyc family_empyrean - Empyrean family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/Electric.exe pyinstaller - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Electric.exe
File Explorer
-
Electric.rar.rar 24.0MB
-
ByfronHook.dll.txt481B
-
Electric.exe.exe 24.2MB
-
main.pyc7KB
-
README.md1KB
-
instructions.txt782B
-
license.txt5KB
ByfronHook.dll.txt
- SHA256 bc9b870d92e2155dc0480d22e4093722af7a8b89ab1bcfc3a73b5130f8049985
- MD5 e3dcca7a93f4f4faccde944da1a107b1
- SHA1 20d852207d5946137cd26eec194f6ff981e77c74
- SHA512 aefd1b6ba29ad9cb12f95e5a2c27a1a503d52da0cdc9c47f1243eb6bb56e45788734b5b56910515e878a96436e498a1c67015a9ee55d58737eea54ff966fbe2c
- MD5 SHA1 SHA512
Electric.exe
- IMPHASH 1e92fd54d65284238a0e3b74b2715062
- SHA256 0185a8f60cec55a50446948d7d4ffbe6750d7112275004d674f405482ca9dd63
- MD5 a2fecf7b96e924527ac915cc9890db72
- SHA1 1dd810f92401e03b295900f9cbb6cd5153d0b409
- SHA512 bf14cea2896c202ceb1dbb46c0339e1d9d36ac7762f484a32e34ceac7412fdb593007ff4cf09179d5e37e93a2d62b15de9cbae6ff67f43ff47099cf0746d79d0
- SSDEEP 393216:+qPnLFXlrFWRhH79E2FXQvyRTDOETgsvcGhilVgrUDA/pMpDfO1DrqH0DKLmMs:zPLFXNFUbrFQvyAE302Zik1pDKw
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
44960
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetCPInfo
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetEnvironmentVariableW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=29395,
count=190, id=261, version=29395,
count=10, id=260, version=29395,
count=4, id=253, version=30818,
count=40, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=17, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=11, id=257, version=29395,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31328,
count=1, id=258, version=31328,
main.pyc
- SHA256 96ff975d55023da9d8250df833ab00b67f9fd5997a7ff1e77db4883c1a560669
- MD5 d7789cd545e990d5514cdd5ec51ee78e
- SHA1 d7f9f74422214163e08209b70b72b33549cc824a
- SHA512 5d8ca20ec2f0b8cd0146c4c6ef6ab5887fee4bc43e0b98573974b58780fc6843b2479173f41e288aa167838af46776bc9d3245350ae5e6d7bb734453d65759c2
- SSDEEP 192:w4WjCD8CphWdXw4/fUbJxFdJhwJnMdwGURnw:TfWuTJ72JnPnw
- MD5 SHA1 SHA512 SSDEEP
-
Detects Empyrean stealer
README.md
- SHA256 032f9da262b974acb90aaa89202788ea9a7bda47bfd86137f559976cd802773e
- MD5 79d5c8aba08210134bb7eb9e1cf74791
- SHA1 6e6aad0f6ebe8b14a63e1b248b2ff018c92331bf
- SHA512 e50de436d90540a50eefc75fc4d120236736ca6352280522c7743b883dc2e3f97eb8116018eda922e81d3f30cc1626fb989bfdab15ae2c5bb57efccf7f08e32b
- MD5 SHA1 SHA512
instructions.txt
- SHA256 aaa8fe5b67a697da13c013e2f6c0b1f6270546c7465da89dd30b9bab2983e788
- MD5 f7d8dd204bba7189119619514bb39ad3
- SHA1 274974a03a1bf7a9a93bbc253612f91134e44ee6
- SHA512 f9b0d97efd246c912915efcdf2e4ed3d089939f1c3b49916f63c178dd5214f74ca56f205330fee425261938690378d004f86d1f3a23edea3bc3d3ee8caf01a6c
- MD5 SHA1 SHA512
license.txt
- SHA256 78f9b5671c16bf36741046442d44d7ebd438d98fc48665313e8fab791d8efe64
- MD5 cf780f5c4be0b2b591af997c8bcd61e8
- SHA1 524a6b4d7ef16014aed5572f6eed2e17ddc2a7be
- SHA512 ec8b4bb8433a187efbcab06da90572cd53c5b83a175d8805af3d5663b8df6b6b760677b3b02e02371918158af81cdd498830c4a6ce8df88530f3b393621e631c
- SSDEEP 96:uE8hju6h4hCZxg9RgpEGsjXyj1imGF4bdXjk3KpaTkS659kQnx1dBHiSkF9tzK/:uEwjuKsgA4+XYdXjA+okS63vZBCSUze
- MD5 SHA1 SHA512 SSDEEP