empyrean | 6ba0f267bcb23a558c5bcdcdbe76255a78e2259df933220849cbe6cef9f856dd | Triage

Resubmissions

13-01-2025 20:53

250113-zn91hazlfj 10

13-01-2025 12:53

250113-p4sq2ssnfx 10

Sharing

General

Target

doxerV7.rar
Size

19.4MB
Sample

250113-zn91hazlfj
MD5

d329a5954b46c1a95e7ba11ad4ff571c
SHA1

4e049a41a57dbb62db4c3e065b6b97fa9d1e03c6
SHA256

6ba0f267bcb23a558c5bcdcdbe76255a78e2259df933220849cbe6cef9f856dd
SHA512

338776ecbbb984e295956ab23adf9d2b01206f1208f25a2df5c1b632d62878710b7bd7ad1ff392db78a50b545f7d606d39454ad8fca0ebcd0c8bd21a07b035e6
SSDEEP

393216:s3pvopOhTYOVNl6P2hdsMPxsb16L8i946J8afFpw2R5jWOZeVS4dxDM/ZeRDEz:s37YOVNl6PuOM01Z6ea9pw2RkOZoSyR4

Score

10^/10

empyrean discovery persistence privilege_escalation pyinstaller spyware stealer

Malware Config

Targets

- Target
  
  doxerV7.rar
- Size
  
  19.4MB
- MD5
  
  d329a5954b46c1a95e7ba11ad4ff571c
- SHA1
  
  4e049a41a57dbb62db4c3e065b6b97fa9d1e03c6
- SHA256
  
  6ba0f267bcb23a558c5bcdcdbe76255a78e2259df933220849cbe6cef9f856dd
- SHA512
  
  338776ecbbb984e295956ab23adf9d2b01206f1208f25a2df5c1b632d62878710b7bd7ad1ff392db78a50b545f7d606d39454ad8fca0ebcd0c8bd21a07b035e6
- SSDEEP
  
  393216:s3pvopOhTYOVNl6P2hdsMPxsb16L8i946J8afFpw2R5jWOZeVS4dxDM/ZeRDEz:s37YOVNl6PuOM01Z6ea9pw2RkOZoSyR4
Score

7^/10

discovery persistence privilege_escalation pyinstaller spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

System Network Configuration Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

pyinstallerempyrean

behavioral1

behavioral2

discoverypersistenceprivilege_escalationpyinstallerspywarestealer