Behavioral task
behavioral1
Sample
2take1.exe
Resource
win10v2004-20240802-en
General
-
Target
2take1.exe.xex
-
Size
17.6MB
-
MD5
2af0882bf0ba4f1fcf786965a34529aa
-
SHA1
7833a9b3b3e9e8d0b4b02e7009a4111a5386a98c
-
SHA256
c54d823bf35bff5175d14831cdce49390185de90435e40ed47073ae5ca642b56
-
SHA512
2d060aeec2c1b6283ca8a8503b297f842f91d41b7f64c4d718a01c71799f07ba192b3b04f45f2ad8ba13a7b93e63697a17a509646b99e49d7100428f95fddb46
-
SSDEEP
393216:qqPnLFXlreQ8DOETgsvfGF1gHJ9yVvEo77EihwCF8q:/PLFXNeQhEYcJ9fo/pwU
Malware Config
Signatures
-
Detects Empyrean stealer 1 IoCs
resource yara_rule static1/unpack001/main.pyc family_empyrean -
Empyrean family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2take1.exe.xex
Files
-
2take1.exe.xex.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
UPX0 Size: - Virtual size: 288KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 114KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 62KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
main.pyc