Overview

overview

10

Static

static

10

empyrean-g...ld.bat

windows7-x64

1

empyrean-g...ld.bat

windows10-2004-x64

8

empyrean-g...ild.py

windows7-x64

3

empyrean-g...ild.py

windows10-2004-x64

8

empyrean-g...fig.py

windows7-x64

3

empyrean-g...fig.py

windows10-2004-x64

8

empyrean-g...env.py

windows7-x64

3

empyrean-g...env.py

windows10-2004-x64

8

empyrean-g...ate.py

windows7-x64

3

empyrean-g...ate.py

windows10-2004-x64

8

empyrean-g...fig.py

windows7-x64

3

empyrean-g...fig.py

windows10-2004-x64

8

empyrean-g...ain.py

windows7-x64

3

empyrean-g...ain.py

windows10-2004-x64

8

empyrean-g...bug.py

windows7-x64

3

empyrean-g...bug.py

windows10-2004-x64

8

empyrean-g...ion.py

windows7-x64

3

empyrean-g...ion.py

windows10-2004-x64

8

empyrean-g...tup.py

windows7-x64

3

empyrean-g...tup.py

windows10-2004-x64

8

empyrean-g...nfo.py

windows7-x64

3

empyrean-g...nfo.py

windows10-2004-x64

8

empyrean-g...fig.py

windows7-x64

3

empyrean-g...fig.py

windows10-2004-x64

8

empyrean-g...ain.py

windows7-x64

3

empyrean-g...ain.py

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    empyrean-grabber.zip

  • Size

    448KB

  • Sample

    250212-2zed3szjfk

  • MD5

    219ba8e948382ad22ef8d8658b541a4e

  • SHA1

    654a205d11cdb821a72ad43886d8dc0ba615cabe

  • SHA256

    795174a48bb492a185ebab88bde39c8ff8b193c3729602a5a8f9425baec7ea1b

  • SHA512

    2c936ee58d7765408c5032dcb3a54dc0ceea6f7508ef2a8dbf7291153e3e8fbc58034a2bfbbd855ee22f21e78e2a9906427315130df5323530b86edc031596d4

  • SSDEEP

    12288:xTnZhjGirlqvEzvDqe35qPPKul52EyHg4F:NZhyvvBeC52xA4F

Score
10/10
empyreanadwarediscoverypersistenceprivilege_escalationstealer

Malware Config

Targets

    • Target

      empyrean-grabber/build.bat

    • Size

      14B

    • MD5

      92a6f2af2e2bf7d6e64b7821f5400d1c

    • SHA1

      ee3e35bf31da9e6616c1c6a663fd19b4d745a279

    • SHA256

      89b15dd343075c7271ec08f848803709a915526e81831af0a9df53577b5155b5

    • SHA512

      57ebb186b961d2e73bfe554f247b53558cd358bba5716578c355a85caf783087495ca15e981bed2c049e4485bb3d5edf413d90b0e16f68ba95bbdc7f26f5b29f

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral1behavioral2

    • Target

      empyrean-grabber/builder/util/build.py

    • Size

      2KB

    • MD5

      b972c3bd98189fef3649132428a6b5d5

    • SHA1

      2f9a0e3bb364be7614062a716e97065df9d091c3

    • SHA256

      ae2d7a498db4f1ea8d4cf1f71a9a60e0379a8b6e287d2c8b7cd2262f45b2d88c

    • SHA512

      b9e9281168c684a8136f299e50293d2d0c0fc92c70ee482a7ed27f1340627c628c0347ab36ee33c72ace95595d2111ee103fbb1ead1e0dbe55a3e85dd2f644f8

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral3behavioral4

    • Target

      empyrean-grabber/builder/util/config.py

    • Size

      2KB

    • MD5

      083bc8cc27286e50c08f0f53876f48a8

    • SHA1

      2a1d0ade3e5b4abba267b9ccfeb2fee681a7f032

    • SHA256

      b5f7ff2bfd9a7fc444076ac74dc7034d9d366152f4fb288eab481597bbf54672

    • SHA512

      832bff211d5fff703c1cfe5b54777e5707c4e9703499edfdaa25865bacb7504bdfe41814033e6269537d692e0c53ee58f6c80184697564adf6969931370f50ca

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral5behavioral6

    • Target

      empyrean-grabber/builder/util/makeenv.py

    • Size

      616B

    • MD5

      9636255856ad526bbc00457b24373c54

    • SHA1

      6fba0fb49e9698f9e8a818dcd02f236f4b07a428

    • SHA256

      210579537257392e13074d978b255c0e2313d9bd089c6e6635adbc0109a90789

    • SHA512

      d29b68a830bbe0e8190243df51a88e883da75cacd5b9824ec98f63c34e07582b49d5281ee89569d00520b0e567eaeccefef60e223cde8de2b06a29ac710b23d9

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral7behavioral8

    • Target

      empyrean-grabber/builder/util/obfuscate.py

    • Size

      1KB

    • MD5

      b5854b3148f23dbb9355d3a30e3315a8

    • SHA1

      e4273fcdd3948fa75960af037bc9a916705c553c

    • SHA256

      c9091f59845b3201e05e4294dd14c54ba77ba3e679998fb4b37ea204544a4650

    • SHA512

      1179ac8391e9ec93c23704eaf3c630ce6fcd3dff5d372449addb7639e4bebb05328b1213b32ce99b37b0ec046b23488d9e0073b7de3129005c57d0056d49b126

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral10behavioral9

    • Target

      empyrean-grabber/builder/util/writeconfig.py

    • Size

      555B

    • MD5

      2b14c9284e5337eb2af6359827b523e9

    • SHA1

      74f35cae83f8830c181240d945c94c162160c331

    • SHA256

      eb1007f66f1c665f2a05156e78df47b7386736c9cdc272dbcc114ab3291029f7

    • SHA512

      264399eb65d810e47bdd85a4cea943ab06937f44cf6510b71f4202cc745d49b3087b369a64d34e9db5e16365defbfd8a45336b0fbd0dba1d3e1972093be94dec

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral11behavioral12

    • Target

      empyrean-grabber/main.py

    • Size

      2KB

    • MD5

      b0560b25d322d9a898b0cb7db896b5d9

    • SHA1

      7d0ac4dbd04dc72f366165f06ade2329617b5cf4

    • SHA256

      dc43fe72534046f2b9169a1914e21196a08a5e66ddd6ecdc6dcb7c98c46660a0

    • SHA512

      c53fa2cdd781548428b954706e1ce91b5606875c97d7b5a0b764f1d20580c198a175078703fafb496a44cee12237ae399b5e52c606ba5eac772261e8813539cd

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral13behavioral14

    • Target

      empyrean-grabber/src/components/antidebug.py

    • Size

      11KB

    • MD5

      47ae6ac6b52d97d6b952b140e82ff9cf

    • SHA1

      eebba9b7e4dd198d4050e597bab281b87d5785da

    • SHA256

      92e1b4427e17cc7ffcce8f62a3bba16455110086314577fa76ba87804dc6803c

    • SHA512

      97bba85c42ba15f48f2c21843bbccc4af7a3b08bd93d44db5361458900c9e3a3d0607cff38e7b078883ffc6d8fad0dcb9a422015f1165442bd7ddeaa32707e5a

    • SSDEEP

      192:0PRZOKV83Gsn8ZBwh9JYmypzrKU8zrPsR0TtsBWaOJjd5vpV5M7/K/m:0ZTd+nJYJzrn+rgeeWaOJjd5vpVCH

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral15behavioral16

    • Target

      empyrean-grabber/src/components/injection.py

    • Size

      2KB

    • MD5

      deaf00b5fa1e87d383d67653e7f9e632

    • SHA1

      615abf76bcfbaf3249e65f5d764cbc8a9c457317

    • SHA256

      9933b323c85c9bf087367660bacf9e5bf46c5e869688af46922560c9b710d9da

    • SHA512

      255fc671802131cfa7bc498a0877116db35fd5b6380b630ccfda37f282956d8a1a6f65dd5414e84659970fa7f461c45ab1b7dedabef8f11beca2f121f8260e8a

    Score
    8/10
    discoveryadwarepersistenceprivilege_escalationstealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral17behavioral18

    • Target

      empyrean-grabber/src/components/startup.py

    • Size

      1KB

    • MD5

      0fede8d83b25bf76cb24df5fafc68bbe

    • SHA1

      3074408484a65ce9e72bd4b9ad6dc774029031f1

    • SHA256

      1c4fb55c0625e037d90c52a47b7dc46f4fd7c400464834e22e6871e00176dc5e

    • SHA512

      74b01d93691bfe176ba6f6d3e8e0827fa4b520c044f05289ee20ee8712eb59f1c13e1b69bed45884fe748366fb28d2000e2d8cafd45512dc9cc932ddec8b6cdc

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral19behavioral20

    • Target

      empyrean-grabber/src/components/systeminfo.py

    • Size

      6KB

    • MD5

      dacc6629a93a629f2e5e8dd6e6ac8752

    • SHA1

      f0b8436cf7d2e9fcc3d84da50955b82b9817eef4

    • SHA256

      e4aa53a74dbe1a23ddd6b678ef982cb1ce680e50385dba761f5e4971944abf8d

    • SHA512

      5ba2c0a24cb45f306bcc5d91be69f5e2ca90bccae0988874491a5e6018858e0a90f5c5b292365f6662c2f812d156e8dac71297afe395ec813a28a75c577c7e2a

    • SSDEEP

      96:o62a5Q8kjqXmBHyCOMHdpvlGa4sVV2iHhhrqZb+zadcTP9eTnSIf:PQRyGTka/T2oOZazaaL9erj

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral21behavioral22

    • Target

      empyrean-grabber/src/config.py

    • Size

      192B

    • MD5

      36b6f6034baef719be778b89b1226a6e

    • SHA1

      f02c63ff4ead4a66e375ae8145d409537b302d78

    • SHA256

      70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac

    • SHA512

      67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129

    Score
    8/10
    discoveryadwarepersistenceprivilege_escalationstealer

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral23behavioral24

    • Target

      empyrean-grabber/src/main.py

    • Size

      1KB

    • MD5

      db5386b5f9edfc7500d0508fc49a9a59

    • SHA1

      4c79b803e2090d86dd38c7671b1a9b5322b3cf3a

    • SHA256

      ddfbeb221f72eaa4c8e2e4dcdf604307dcfd0d9168c0837a10110cd809f82060

    • SHA512

      a5c6435242930285e41e98e7284fdb0708f654b849e697bd10e8ad12631d5e83e647b775a1bf6d61b9a2958d4969c475055ff3071affcefceed3234b92d69634

    Score
    8/10
    discovery

    • Downloads MZ/PE file

    behavioral25behavioral26

MITRE ATT&CK Enterprise v15

Tasks

static1

empyrean
Score
10/10

behavioral1

Score
1/10

behavioral2

discovery
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
8/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
8/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
8/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
8/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
8/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
8/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
8/10

behavioral17

discovery
Score
3/10

behavioral18

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
8/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
8/10

behavioral23

discovery
Score
3/10

behavioral24

adwarediscoverypersistenceprivilege_escalationstealer
Score
8/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
8/10