empyrean | 4ee66020bf8fd5606f1fa1835a6c2328aab1556035e44a2de60b87c8f8571375

General

Target

tri.rar
Size

17.5MB
Sample

241201-nw2tbazrfy
MD5

48fd699e9cba54f5c9fb09a3d362aedf
SHA1

f130049b001902d7fcad58f13d6b47f0d055acca
SHA256

4ee66020bf8fd5606f1fa1835a6c2328aab1556035e44a2de60b87c8f8571375
SHA512

7e80794fb6d765ef42236c4fa16a53f817df2a163e944a31513344c1d74379a1ca5df02eafd188294c65b39c47db7d748c30de58ae95693bf161216bcb67e6a8
SSDEEP

393216:1vAMSV/Hy1IrjMr8wyVQvm21KpM1pfWbQVjxm3rYR:1oPyOkwBCpK6WsVtm3rC

Score

10^/10

Malware Config

Targets

- Target
  
  tri.rar
- Size
  
  17.5MB
- MD5
  
  48fd699e9cba54f5c9fb09a3d362aedf
- SHA1
  
  f130049b001902d7fcad58f13d6b47f0d055acca
- SHA256
  
  4ee66020bf8fd5606f1fa1835a6c2328aab1556035e44a2de60b87c8f8571375
- SHA512
  
  7e80794fb6d765ef42236c4fa16a53f817df2a163e944a31513344c1d74379a1ca5df02eafd188294c65b39c47db7d748c30de58ae95693bf161216bcb67e6a8
- SSDEEP
  
  393216:1vAMSV/Hy1IrjMr8wyVQvm21KpM1pfWbQVjxm3rYR:1oPyOkwBCpK6WsVtm3rC
Score

7^/10

discovery persistence privilege_escalation pyinstaller spyware stealer upx
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1
- Target
  
  Lunar spoofer.exe
- Size
  
  17.7MB
- MD5
  
  307c9c8d33c5e29dedbdfcefa76fb08f
- SHA1
  
  412d4dfde8ce9c5ae4cbaec828a7b7d75e9ca85e
- SHA256
  
  ee7be92913e679dd66d5a5a62cc8b78a4093da9344cce8ab7058fc8e6ea766c4
- SHA512
  
  278ecaace8468273c9ec6eb47f8435e31cb4525124dd9e0142f49e3825a23d5fcb95b4e9e17a74432c2f5dd3d9b736c4009f0d59d952ff0c01429416cb394245
- SSDEEP
  
  393216:gqPnLFXlrVgQpDOETgsvfGzugNsxqvEiA/IQGL7Sq:hPLFXN6QoEx2sZiykv
Score

7^/10

discovery persistence privilege_escalation spyware stealer upx
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral2
- Target
  
  main.pyc
- Size
  
  7KB
- MD5
  
  8520638ea1de26a39485ef194f21d2d9
- SHA1
  
  38a3cf1e726c90ca907bd4e88b4e1c410039639d
- SHA256
  
  5d5bca522b2ee14d11631b91a78f823988aed232b6e0aa6f3f7f107d38eefdab
- SHA512
  
  3c89a9d757acead75e1c6582f27f82b06d33d7cbc5916def26c5f03610508508598b4bc88b092afb9427a071b062cd5cfc833c19e6f1e9840df5ab94a893a82c
- SSDEEP
  
  192:w5UjGWD8civfWdXwT8N2J8WMJhwZhJUMdwiBnw:oPWunpA2ZhaP8w
Score

3^/10
behavioral3
- Target
  
  read me.txt
- Size
  
  41B
- MD5
  
  83c53c59428011fe02c705c27d7ff228
- SHA1
  
  573f22ba205cd2c4f7eef788a2d422a6e3cc86fd
- SHA256
  
  8fd8346058823f62a0516283250751ef804fe7b89c7f3a7f40bf52adc4cf424d
- SHA512
  
  fb44cb38ddf500fa35b742636ff51ac40995406429fa5aaae4475b7dfc93ad955099638e8f8d5b0d5f1d6a39e05eb11052267789786af1f4566099df259fc881
Score

1^/10
behavioral4
- Target
  
  serial_checker.bat
- Size
  
  1KB
- MD5
  
  efa2cd30989448f5690130b07ccce86a
- SHA1
  
  0c3203f67c67cf63d39894a0577f20d5dc1427e8
- SHA256
  
  86710039b7414ff861ca629c839e89eb5eaf74cff86129734c575e5716c1a552
- SHA512
  
  c2f7dfb10f311ba6684651ca4e8aee8408e5abf6c2f564ce2764c0bac8df07da0b742bedff992d2ff9f6b00a1d6b1423d09390653c0fd0d47303984183db358e
Score

1^/10
behavioral5