Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

empyrean-g...r3.dll

windows10-2004-x64

1

empyrean-g...r3.dll

windows7-x64

1

empyrean-g...r3.dll

windows10-2004-x64

1

empyrean-g...r3.dll

windows7-x64

1

empyrean-g...r3.dll

windows10-2004-x64

1

empyrean-g...er.exe

windows7-x64

7

empyrean-g...er.exe

windows10-2004-x64

7

main.pyc

windows7-x64

3

main.pyc

windows10-2004-x64

3

empyrean-g...r3.dll

windows7-x64

1

empyrean-g...r3.dll

windows10-2004-x64

1

empyrean-g...r3.dll

windows7-x64

1

empyrean-g...r3.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    empyrean-grabber-discord-main.zip

  • Size

    17.4MB

  • Sample

    250226-wekgpsxxaw

  • MD5

    c0cbaad482c7fc2b29f36233cf7ce6a2

  • SHA1

    ae2f3fbd0dbf7f7c4431d3d70320db94a458d050

  • SHA256

    0f6488ec68bc79c8f5987d1d97c32bc164033639d13f3bbcb0e7d2a6017b1c54

  • SHA512

    0a60e260a49ce9638329f71109d1e9cf69ad64a93a9f3abcdac5a6a30f4f5d56e666fa6c044cd0c9ab69fe50b68a06bfa0d27ba097de58ae7c6ed6cc273f7d28

  • SSDEEP

    393216:vqJwbeaHlLDseZC7oKqU0CVAjWXIk+DkqDs:iGbeaHlLDTVYOiTqDs

Score
10/10
empyreandiscoverypersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      empyrean-grabber-discord-main/D3DCompiler_47_cor3.dll

    • Size

      4.7MB

    • MD5

      ca68272d2c97f1e145f50b8cd1edf3a6

    • SHA1

      83097400436f111c13ee34740e66b3de0542914b

    • SHA256

      ff5dddae92b3798cc00c14a706ecb6329c27aa6d7bb6e82b393cf8b7366458ba

    • SHA512

      ffc670aea4dad0113196d594c0fd07a838123e485ffebe3b728b8a18403b0bb82b042ccf23019c850a62466990b10a2e94102178326df735e4815dba7811d502

    • SSDEEP

      49152:TCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvKiD0N+YEzI4og/RfzHLeHTRhFRN+:KG2QCwmHwnog/pzHAo/AG3

    Score
    1/10
    behavioral1

    • Target

      empyrean-grabber-discord-main/PenImc_cor3.dll

    • Size

      155KB

    • MD5

      1af534a2cbc3dcaafdf861efce478944

    • SHA1

      81d646f23f0d6f4cad727dd06beaf82d3483e979

    • SHA256

      b8c28024b5eb2d4f0ea19add6fea32c528e87ec7c3b34c35cd8a90b137e238b1

    • SHA512

      66931fc841e4ef3f101d47e725d7ed9105232e85e3a0f284070c704c1e5812bb15d6505e85b06ec68eea7fbfa5f080eaf8ea85170b328bb93ef5cbaf13302ec4

    • SSDEEP

      3072:jB0iZ4dTEcpg0/vzSaZxFwDEzr+uErjBkATZ+4gCeY47l1f9XD:jBlZ4dTBg0HuaFwomuErjBvnVOR9T

    Score
    1/10
    behavioral2behavioral3

    • Target

      empyrean-grabber-discord-main/PresentationNative_cor3.dll

    • Size

      1.2MB

    • MD5

      5a137f1c0db458b0e5bb642f5293d3e6

    • SHA1

      6f66bf8ad1a930c7021a95025b81af6169508a08

    • SHA256

      334a78b0e495b25b9b828216c4613a8a169129c583245da3c3b2b923d4e4c39b

    • SHA512

      d645f9c57523296923e2753202dbcd2a09f75bf46ac9a5a5525182d1d90b6f2fb078789150f4aeeafca8717098670780cbdb1e81fdb7fdd32d5ad791a2cafc79

    • SSDEEP

      24576:xiRg8yz18WtBro/oH0NNcv/v2L7gzPGNvmAhhYdI/H+mrw0xvrSEWuG6:x58yzPtBro2v/vsgzutmAhb/H+AxvrFN

    Score
    1/10
    behavioral4behavioral5

    • Target

      empyrean-grabber-discord-main/empyrean-grabber.exe

    • Size

      13.9MB

    • MD5

      b7b42257daa03a0168ef7b4e93de5c38

    • SHA1

      2fe8e6a3317eed73f30dac4cb5479d6f2f9ad1e5

    • SHA256

      b6dfc114d83e5f953729df3890e960d954fef6d46d0c24b2ab1684c140f88df6

    • SHA512

      481219d6c6531c0d7cb611804aa87ad0965f3975e39ad8a9765907b0723ef36021ef0614f6766bf8ac0f645c33910f4e56afcedbe626fdf4586a9e5fa1170058

    • SSDEEP

      196608:8c/lOqPupb7KX/x1HhAehNJm3AqdKDnO8NpkSgsAGKaR2+UPtUFxnZwk0cJujEFE:+qPuYXJBx/m3pgDOEkSgsv9it+nx0/D

    Score
    7/10
    upxdiscoverypersistenceprivilege_escalationspywarestealer

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral6behavioral7

    • Target

      main.pyc

    • Size

      1KB

    • MD5

      a90ad26122ed9db72b91bdf4ceaf749d

    • SHA1

      cf8fe4d0d0e8ca258c3c5f201d59a04cd332e214

    • SHA256

      bcccbdda9e4bdeb841f6a448e644d942bad2aeb7598b38cbfd94dcee184229b1

    • SHA512

      b307159442c9a637b279e7d9efa70ca8693575d33ffb18de4b348e483292da912a817d8644a5ccc66189f92e8cee8aba3ce6a82572facf676230cc832b02c8eb

    Score
    3/10
    discovery
    behavioral8behavioral9

    • Target

      empyrean-grabber-discord-main/vcruntime140_cor3.dll

    • Size

      106KB

    • MD5

      870fea4e961e2fbd00110d3783e529be

    • SHA1

      a948e65c6f73d7da4ffde4e8533c098a00cc7311

    • SHA256

      76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

    • SHA512

      0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

    • SSDEEP

      1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/

    Score
    1/10
    behavioral10behavioral11

    • Target

      empyrean-grabber-discord-main/wpfgfx_cor3.dll

    • Size

      1.9MB

    • MD5

      7c376486f11fd44758196ce317341bd6

    • SHA1

      0df8ce081c769c723fb59a72516032b962b12dd7

    • SHA256

      469f27d29c4383c16c69ed1dbe49f2d9330e77601a4508e4682b6b60448af2ba

    • SHA512

      0d8a5158635a8351413bea932766f14c1802742a2b2d7ab1040b6b38aec0adcb11b33eed2e042905b842e13e1437c5e1bc4edd3f6401492f7b6a59bb9ee9a272

    • SSDEEP

      24576:EhlzrrAC0skg3Mp048GyZSerDtkKVSvoAna/eOvAnoogfTl4sbUrbk88Ev9L1p9H:krrx0HgcK3xIODttzmIFlogJerr1bH

    Score
    1/10
    behavioral12behavioral13

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks