empyrean | 15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd

Sharing

Copy URL

Twitter E-mail

General

Target

empyrean-main.zip
Size

458KB
Sample

241130-t268waymby
MD5

6535abdad3ba947fa280b8d5f836751b
SHA1

5c7d20d35bcd2049fea5c07ad4d83e4e0e2fb494
SHA256

15f5346f636fa7879882f23611d46da7d7fab3e03cf75366f8721fe54804f8fd
SHA512

5edc1bac7c636d2488578d97544cedd18f61124f2a732b49ffd891aeac00a19af6dc4c42e8e4c9e52f5ae0e908f059219f0ceae698d9084453335877bea132a1
SSDEEP

12288:oHl1OgPc6NQpZZbzYQqKevezSE3l52fsl:oH26CpZNUvezH52w

Score

10^/10

Malware Config

Targets

- Target
  
  empyrean-main/build.bat
- Size
  
  634B
- MD5
  
  947b2de91d99e17ff1bd006f0cb2ec58
- SHA1
  
  1058ab07fcef83998f420ff322c1cb08fb4ce0c0
- SHA256
  
  2158894b4803edf23d2fe3988fce3ffcd190106204596e38b205c013ac317778
- SHA512
  
  7a6356453e1547866fa5db754bda156eeefe4f824daeb7e5961292a047abe443cb0e8d21794016173458d029770d2062fad6c9794b9bc040549a5d24e319fc54
Score

1^/10
behavioral1
- Target
  
  empyrean-main/builder/main.py
- Size
  
  1KB
- MD5
  
  ba1fda5f75f9c66d0cc0c0b8c765f3b5
- SHA1
  
  24910918fea9ce6fea7e5fb8789c0af5269d867a
- SHA256
  
  babf25f3a055d02fae10d5b68b909bd60cfbb7772eb726bd7d617c488db221d0
- SHA512
  
  d9cc84eabd33bafcf0348f2bd9c421baa1559a0a6aa871c66826645fc01fba19491647b93a54baedc6f3e1da1c88546455d0e99b045837a6464494c2953de025
Score

3^/10
behavioral2
- Target
  
  empyrean-main/builder/util/build.py
- Size
  
  2KB
- MD5
  
  b972c3bd98189fef3649132428a6b5d5
- SHA1
  
  2f9a0e3bb364be7614062a716e97065df9d091c3
- SHA256
  
  ae2d7a498db4f1ea8d4cf1f71a9a60e0379a8b6e287d2c8b7cd2262f45b2d88c
- SHA512
  
  b9e9281168c684a8136f299e50293d2d0c0fc92c70ee482a7ed27f1340627c628c0347ab36ee33c72ace95595d2111ee103fbb1ead1e0dbe55a3e85dd2f644f8
Score

3^/10
behavioral3
- Target
  
  empyrean-main/builder/util/config.py
- Size
  
  2KB
- MD5
  
  083bc8cc27286e50c08f0f53876f48a8
- SHA1
  
  2a1d0ade3e5b4abba267b9ccfeb2fee681a7f032
- SHA256
  
  b5f7ff2bfd9a7fc444076ac74dc7034d9d366152f4fb288eab481597bbf54672
- SHA512
  
  832bff211d5fff703c1cfe5b54777e5707c4e9703499edfdaa25865bacb7504bdfe41814033e6269537d692e0c53ee58f6c80184697564adf6969931370f50ca
Score

3^/10
behavioral4
- Target
  
  empyrean-main/builder/util/makeenv.py
- Size
  
  616B
- MD5
  
  9636255856ad526bbc00457b24373c54
- SHA1
  
  6fba0fb49e9698f9e8a818dcd02f236f4b07a428
- SHA256
  
  210579537257392e13074d978b255c0e2313d9bd089c6e6635adbc0109a90789
- SHA512
  
  d29b68a830bbe0e8190243df51a88e883da75cacd5b9824ec98f63c34e07582b49d5281ee89569d00520b0e567eaeccefef60e223cde8de2b06a29ac710b23d9
Score

3^/10
behavioral5
- Target
  
  empyrean-main/builder/util/obfuscate.py
- Size
  
  1KB
- MD5
  
  b5854b3148f23dbb9355d3a30e3315a8
- SHA1
  
  e4273fcdd3948fa75960af037bc9a916705c553c
- SHA256
  
  c9091f59845b3201e05e4294dd14c54ba77ba3e679998fb4b37ea204544a4650
- SHA512
  
  1179ac8391e9ec93c23704eaf3c630ce6fcd3dff5d372449addb7639e4bebb05328b1213b32ce99b37b0ec046b23488d9e0073b7de3129005c57d0056d49b126
Score

3^/10
behavioral6
- Target
  
  empyrean-main/builder/util/writeconfig.py
- Size
  
  555B
- MD5
  
  2b14c9284e5337eb2af6359827b523e9
- SHA1
  
  74f35cae83f8830c181240d945c94c162160c331
- SHA256
  
  eb1007f66f1c665f2a05156e78df47b7386736c9cdc272dbcc114ab3291029f7
- SHA512
  
  264399eb65d810e47bdd85a4cea943ab06937f44cf6510b71f4202cc745d49b3087b369a64d34e9db5e16365defbfd8a45336b0fbd0dba1d3e1972093be94dec
Score

3^/10
behavioral7
- Target
  
  empyrean-main/install_python.bat
- Size
  
  686B
- MD5
  
  f30718a354e7cc104ea553ce5ae2d486
- SHA1
  
  3876134e6b92da57a49d868013ed35b5d946f8fd
- SHA256
  
  94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966
- SHA512
  
  601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral8
- Target
  
  empyrean-main/src/components/antidebug.py
- Size
  
  11KB
- MD5
  
  47ae6ac6b52d97d6b952b140e82ff9cf
- SHA1
  
  eebba9b7e4dd198d4050e597bab281b87d5785da
- SHA256
  
  92e1b4427e17cc7ffcce8f62a3bba16455110086314577fa76ba87804dc6803c
- SHA512
  
  97bba85c42ba15f48f2c21843bbccc4af7a3b08bd93d44db5361458900c9e3a3d0607cff38e7b078883ffc6d8fad0dcb9a422015f1165442bd7ddeaa32707e5a
- SSDEEP
  
  192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/K/m:0ZTd+nJYJzrn+rgeeWaOJjd5vpVCH
Score

3^/10
behavioral9
- Target
  
  empyrean-main/src/components/browsers.py
- Size
  
  11KB
- MD5
  
  720067bf62202ab20bd0bdce2404b294
- SHA1
  
  7c60970fd79957309b84b4265671ee7ebe7161c0
- SHA256
  
  38ddcdaa3f2ac2bbac94d7b34cc708449aec108fd2065f3555053e8916544b77
- SHA512
  
  20f10bd12ecac1f3197b7611a4911ce7f232a16432b465bc5346dd1e5c288de56042c6144104d54bc2ee53acc0bf9c98d2baf972a4b4b9aa9ce655080462f0e8
- SSDEEP
  
  192:Yo1etBr/e8k03E5YYul25ZXIbHYsq5w/wVbPRfwmbd5NcbtU03vbt2w79G+R5:gzEhFsq5w/wPfwCN903Uw73R5
Score

3^/10
behavioral10
- Target
  
  empyrean-main/src/components/discordtoken.py
- Size
  
  17KB
- MD5
  
  91d7fa95e5af17a5132378a15d855d01
- SHA1
  
  86b8f0e7a87bf913874f9d4d1e823581c6020e5e
- SHA256
  
  272e576f88e24667b784c1d8f08fcde3ebb13a126e216f1ab25a49b3fa1b6eb1
- SHA512
  
  0a22a3738ab6d60ab143ba6fd34755dd5e501b55f10a72c731672c9ee3a564e4dc7ab070d7f9ae4d1f3abd5d544ba723cd629e14dded7103ab323a7301a582c6
- SSDEEP
  
  384:Cg9WPIDbhMUN7ir4hq4hM6vPhQ6pn3hRJPuEbq7rqLmBvS6:YIz704g4a6Xh5pn3hRrbcr8UK6
Score

3^/10
behavioral11
- Target
  
  empyrean-main/src/components/injection.py
- Size
  
  2KB
- MD5
  
  deaf00b5fa1e87d383d67653e7f9e632
- SHA1
  
  615abf76bcfbaf3249e65f5d764cbc8a9c457317
- SHA256
  
  9933b323c85c9bf087367660bacf9e5bf46c5e869688af46922560c9b710d9da
- SHA512
  
  255fc671802131cfa7bc498a0877116db35fd5b6380b630ccfda37f282956d8a1a6f65dd5414e84659970fa7f461c45ab1b7dedabef8f11beca2f121f8260e8a
Score

3^/10
behavioral12
- Target
  
  empyrean-main/src/components/startup.py
- Size
  
  1KB
- MD5
  
  0fede8d83b25bf76cb24df5fafc68bbe
- SHA1
  
  3074408484a65ce9e72bd4b9ad6dc774029031f1
- SHA256
  
  1c4fb55c0625e037d90c52a47b7dc46f4fd7c400464834e22e6871e00176dc5e
- SHA512
  
  74b01d93691bfe176ba6f6d3e8e0827fa4b520c044f05289ee20ee8712eb59f1c13e1b69bed45884fe748366fb28d2000e2d8cafd45512dc9cc932ddec8b6cdc
Score

3^/10
behavioral13
- Target
  
  empyrean-main/src/components/systeminfo.py
- Size
  
  6KB
- MD5
  
  dacc6629a93a629f2e5e8dd6e6ac8752
- SHA1
  
  f0b8436cf7d2e9fcc3d84da50955b82b9817eef4
- SHA256
  
  e4aa53a74dbe1a23ddd6b678ef982cb1ce680e50385dba761f5e4971944abf8d
- SHA512
  
  5ba2c0a24cb45f306bcc5d91be69f5e2ca90bccae0988874491a5e6018858e0a90f5c5b292365f6662c2f812d156e8dac71297afe395ec813a28a75c577c7e2a
- SSDEEP
  
  96:o62a5Q8kjqXmBHyCOMHdpvlGa4sVV2iHhhrqZb+zadcTP9eTnSIf:PQRyGTka/T2oOZazaaL9erj
Score

3^/10
behavioral14
- Target
  
  empyrean-main/src/config.py
- Size
  
  192B
- MD5
  
  36b6f6034baef719be778b89b1226a6e
- SHA1
  
  f02c63ff4ead4a66e375ae8145d409537b302d78
- SHA256
  
  70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac
- SHA512
  
  67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129
Score

3^/10
behavioral15
- Target
  
  empyrean-main/src/main.py
- Size
  
  1KB
- MD5
  
  db5386b5f9edfc7500d0508fc49a9a59
- SHA1
  
  4c79b803e2090d86dd38c7671b1a9b5322b3cf3a
- SHA256
  
  ddfbeb221f72eaa4c8e2e4dcdf604307dcfd0d9168c0837a10110cd809f82060
- SHA512
  
  a5c6435242930285e41e98e7284fdb0708f654b849e697bd10e8ad12631d5e83e647b775a1bf6d61b9a2958d4969c475055ff3071affcefceed3234b92d69634
Score

3^/10
behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16