Overview

overview

10

Static

static

10

empyrean-m...ld.bat

windows7-x64

1

empyrean-m...ld.bat

windows10-2004-x64

1

empyrean-m...on.bat

windows7-x64

8

empyrean-m...on.bat

windows10-2004-x64

8

empyrean-m...bug.py

windows7-x64

3

empyrean-m...bug.py

windows10-2004-x64

3

empyrean-m...ers.py

windows7-x64

3

empyrean-m...ers.py

windows10-2004-x64

3

empyrean-m...ken.py

windows7-x64

3

empyrean-m...ken.py

windows10-2004-x64

3

empyrean-m...ion.py

windows7-x64

3

empyrean-m...ion.py

windows10-2004-x64

3

empyrean-m...tup.py

windows7-x64

3

empyrean-m...tup.py

windows10-2004-x64

3

empyrean-m...nfo.py

windows7-x64

3

empyrean-m...nfo.py

windows10-2004-x64

3

empyrean-m...fig.py

windows7-x64

3

empyrean-m...fig.py

windows10-2004-x64

3

empyrean-m...ain.py

windows7-x64

3

empyrean-m...ain.py

windows10-2004-x64

3

empyrean-m...tup.py

windows7-x64

3

empyrean-m...tup.py

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    empyrean-main.zip

  • Size

    452KB

  • Sample

    241211-aveqha1pep

  • MD5

    e9fdd176cca5a1dd301f3b679fa500a7

  • SHA1

    996e6c46c9cc48bf07b82fbd73c3ea2a5812743b

  • SHA256

    aa79ac94e2d1d633c9ac7953978506f1437239c8d55a33a2691e3184fb5ca5a1

  • SHA512

    547d1b486b47bd1fbae3e0cf83293dd6fd77abdea7afdad50f54c521541cfdd44722eda8872c7652a261d3023e96b3a0e8ecb3323df6aa5d132208e0f889c50f

  • SSDEEP

    12288:LHl1OFPc6NQpZZgzYQqZe4ezSEul52fsr:LHD6CpZmN4ez+52A

Score
10/10
empyreandiscoveryexecution

Malware Config

Targets

    • Target

      empyrean-main/build.bat

    • Size

      661B

    • MD5

      02999ead0aaf6abffd2517a3a6f5f1ba

    • SHA1

      fa21a96e98fa69c33c9a61bcaaeb7c32c2d0bd34

    • SHA256

      9ffb159c02ea6f5f1214325f381c991244a092c95d63741a07e785af9063f144

    • SHA512

      66eb88ce8de38eaf90f294a6a97c4dea8dbfaafb928a7f27360fa3d1b244dda73f542d8ad15e0591534e797c44c0f1a0f533bcf5291d3f80329bcc95c97b6d29

    Score
    1/10
    behavioral1behavioral2

    • Target

      empyrean-main/install_python.bat

    • Size

      686B

    • MD5

      f30718a354e7cc104ea553ce5ae2d486

    • SHA1

      3876134e6b92da57a49d868013ed35b5d946f8fd

    • SHA256

      94008c8135d149fecd29ca62aded487f0fbfa6af893596ffc3e4b621a0fe4966

    • SHA512

      601b2256ea709a885741f1dec5c97dda6fb7fd4e485b4afac3503af1aefe73472e5bc5529c144814a3defbc0b51ac4b50e02a50dccc69b41ee5d87a3f4282874

    Score
    8/10
    executiondiscovery

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral3behavioral4

    • Target

      empyrean-main/src/components/antidebug.py

    • Size

      11KB

    • MD5

      47ae6ac6b52d97d6b952b140e82ff9cf

    • SHA1

      eebba9b7e4dd198d4050e597bab281b87d5785da

    • SHA256

      92e1b4427e17cc7ffcce8f62a3bba16455110086314577fa76ba87804dc6803c

    • SHA512

      97bba85c42ba15f48f2c21843bbccc4af7a3b08bd93d44db5361458900c9e3a3d0607cff38e7b078883ffc6d8fad0dcb9a422015f1165442bd7ddeaa32707e5a

    • SSDEEP

      192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/K/m:0ZTd+nJYJzrn+rgeeWaOJjd5vpVCH

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      empyrean-main/src/components/browsers.py

    • Size

      11KB

    • MD5

      720067bf62202ab20bd0bdce2404b294

    • SHA1

      7c60970fd79957309b84b4265671ee7ebe7161c0

    • SHA256

      38ddcdaa3f2ac2bbac94d7b34cc708449aec108fd2065f3555053e8916544b77

    • SHA512

      20f10bd12ecac1f3197b7611a4911ce7f232a16432b465bc5346dd1e5c288de56042c6144104d54bc2ee53acc0bf9c98d2baf972a4b4b9aa9ce655080462f0e8

    • SSDEEP

      192:Yo1etBr/e8k03E5YYul25ZXIbHYsq5w/wVbPRfwmbd5NcbtU03vbt2w79G+R5:gzEhFsq5w/wPfwCN903Uw73R5

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      empyrean-main/src/components/discordtoken.py

    • Size

      17KB

    • MD5

      91d7fa95e5af17a5132378a15d855d01

    • SHA1

      86b8f0e7a87bf913874f9d4d1e823581c6020e5e

    • SHA256

      272e576f88e24667b784c1d8f08fcde3ebb13a126e216f1ab25a49b3fa1b6eb1

    • SHA512

      0a22a3738ab6d60ab143ba6fd34755dd5e501b55f10a72c731672c9ee3a564e4dc7ab070d7f9ae4d1f3abd5d544ba723cd629e14dded7103ab323a7301a582c6

    • SSDEEP

      384:Cg9WPIDbhMUN7ir4hq4hM6vPhQ6pn3hRJPuEbq7rqLmBvS6:YIz704g4a6Xh5pn3hRrbcr8UK6

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      empyrean-main/src/components/injection.py

    • Size

      2KB

    • MD5

      deaf00b5fa1e87d383d67653e7f9e632

    • SHA1

      615abf76bcfbaf3249e65f5d764cbc8a9c457317

    • SHA256

      9933b323c85c9bf087367660bacf9e5bf46c5e869688af46922560c9b710d9da

    • SHA512

      255fc671802131cfa7bc498a0877116db35fd5b6380b630ccfda37f282956d8a1a6f65dd5414e84659970fa7f461c45ab1b7dedabef8f11beca2f121f8260e8a

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      empyrean-main/src/components/startup.py

    • Size

      1KB

    • MD5

      0fede8d83b25bf76cb24df5fafc68bbe

    • SHA1

      3074408484a65ce9e72bd4b9ad6dc774029031f1

    • SHA256

      1c4fb55c0625e037d90c52a47b7dc46f4fd7c400464834e22e6871e00176dc5e

    • SHA512

      74b01d93691bfe176ba6f6d3e8e0827fa4b520c044f05289ee20ee8712eb59f1c13e1b69bed45884fe748366fb28d2000e2d8cafd45512dc9cc932ddec8b6cdc

    Score
    3/10
    discovery
    behavioral13behavioral14

    • Target

      empyrean-main/src/components/systeminfo.py

    • Size

      6KB

    • MD5

      dacc6629a93a629f2e5e8dd6e6ac8752

    • SHA1

      f0b8436cf7d2e9fcc3d84da50955b82b9817eef4

    • SHA256

      e4aa53a74dbe1a23ddd6b678ef982cb1ce680e50385dba761f5e4971944abf8d

    • SHA512

      5ba2c0a24cb45f306bcc5d91be69f5e2ca90bccae0988874491a5e6018858e0a90f5c5b292365f6662c2f812d156e8dac71297afe395ec813a28a75c577c7e2a

    • SSDEEP

      96:o62a5Q8kjqXmBHyCOMHdpvlGa4sVV2iHhhrqZb+zadcTP9eTnSIf:PQRyGTka/T2oOZazaaL9erj

    Score
    3/10
    discovery
    behavioral15behavioral16

    • Target

      empyrean-main/src/config.py

    • Size

      192B

    • MD5

      36b6f6034baef719be778b89b1226a6e

    • SHA1

      f02c63ff4ead4a66e375ae8145d409537b302d78

    • SHA256

      70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac

    • SHA512

      67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      empyrean-main/src/main.py

    • Size

      1KB

    • MD5

      db5386b5f9edfc7500d0508fc49a9a59

    • SHA1

      4c79b803e2090d86dd38c7671b1a9b5322b3cf3a

    • SHA256

      ddfbeb221f72eaa4c8e2e4dcdf604307dcfd0d9168c0837a10110cd809f82060

    • SHA512

      a5c6435242930285e41e98e7284fdb0708f654b849e697bd10e8ad12631d5e83e647b775a1bf6d61b9a2958d4969c475055ff3071affcefceed3234b92d69634

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      empyrean-main/src/setup.py

    • Size

      397B

    • MD5

      a8e335bacc26299143e4f75e199b5d1b

    • SHA1

      0ecfcd63d0d68ddf076dc8e1365e06f0cf14ba63

    • SHA256

      0416c23471a32dd17c441ba1202f9ce7e8eb6065d2798285b68eb81ba89e40e3

    • SHA512

      3ec9bba6994effdbdeb078dd83ae5f7587433358248e905e426ed0f7644bb62a9f80a088959cd4f6dd7418f2d0096ad3526a69da48345378d0629ed6ee6f2560

    Score
    3/10
    discovery
    behavioral21behavioral22

MITRE ATT&CK Enterprise v15

Tasks