epsilon | a2077125de69b773350e3d1875f71d5433d85bcaa4f1fccce75a59a78cfef668

Sharing

Copy URL Twitter E-mail

General

Target
GalacticShooter.exe
Size 61.8MB
Sample251202-3bkfvscm4y
SHA256 a2077125de69b773350e3d1875f71d5433d85bcaa4f1fccce75a59a78cfef668
MD5 9e8685a5687ecdcca340c120f0504ec1
SHA1 c8261b0ac6d5ea4b1b16de8e58f73a8307d24949
SHA512 e2ea26bad68e717bfee78a7913f3ab1284c8b89a6c75cfc9f50f02ffdfa21653f209ed072b1fb31429b7cc8413c19dc5e34ab10ce0571c0609965d10f824b35c
SSDEEP 1572864:JtveqM8531VcinHaBHNYV6vSAuZ8F0Po7:Jl/pFbnq6xbPo7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  GalacticShooter.exe
- Size 61.8MB
- SHA256 a2077125de69b773350e3d1875f71d5433d85bcaa4f1fccce75a59a78cfef668
- MD5 9e8685a5687ecdcca340c120f0504ec1
- SHA1 c8261b0ac6d5ea4b1b16de8e58f73a8307d24949
- SHA512 e2ea26bad68e717bfee78a7913f3ab1284c8b89a6c75cfc9f50f02ffdfa21653f209ed072b1fb31429b7cc8413c19dc5e34ab10ce0571c0609965d10f824b35c
- SSDEEP 1572864:JtveqM8531VcinHaBHNYV6vSAuZ8F0Po7:Jl/pFbnq6xbPo7
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

discovery epsilon spyware stealer
- Detects EpsilonStealer ASAR
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Epsilon family
  epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  GalacticShooter.exe
- Size 140.1MB
- SHA256 38c81e9d17174f56bf3c22e5994d341ad041254ada2743160b69d893b8d51eda
- MD5 93bd0ae322d0293b5aff20c25b1f71a2
- SHA1 6f9c06ed0f5a43826ba928ee1c818a69a52c2c7a
- SHA512 b844328e8bd38b21ea94d1b501ca6e6d6b19e731a6097226f09a71466485f5717082f20ba87b3caae7457f43f97ebbe33cc96b59b312ebaba1b7d623e24a8f59
- SSDEEP 1572864:CFPFqg/QDqnOeMvLq82U/pmmKKmB7Bg2N:EQfhbbmBL
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

epsilon spyware stealer
- Epsilon Stealer
  Information stealer.
  stealer epsilon
- Epsilon family
  epsilon
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral7 behavioral8
- Target
  LICENSES.chromium.html
- Size 5.3MB
- SHA256 501f0b7ebf0be7ed8702d317332a0f8820af837c0a2a1d7645ba04352270e2b8
- MD5 dfa12f4edccb902d7d3b07fae219f176
- SHA1 c2073440a5add265b4143de05e6864fed2c3b840
- SHA512 eee3a8e0eeae139ddd9369d0869c29c91007bf6c5b0d7982918d5a013214a9e80b9233e7c1ccb43124152f684f0b782831b0a6b3d126558261dd161230004e50
- SSDEEP 12288:FetnJnVncnJnknE9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX04nNWQFna:WbXZ5IoWSL9bcwVR8mf+/cHBBaRp1
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 b827172262cea032be8303aae69a947a8d867006269bb8b2bc7e77619333c1b6
- MD5 21647425561f9dfa567139d2c505f585
- SHA1 efd5b3d6a21886c6467d28c73d20be0acb4591e9
- SHA512 c5316a6b2d77cf2c2949698f9cba92fe1ec57b2ac82d55fbbeffe71b4834ec06e83728a176f5089c91cc9544deda0667f39338f1e9d1a37db69bd8bad4af915a
- SSDEEP 49152:tJTlgrbjpHr7KxPTiqdU9YRDQ2K7Fz68ZxxJ0JoC3MCfuTEM+:bOx39YRikMiu4
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12 behavioral13
- Target
  libEGL.dll
- Size 437KB
- SHA256 43a549ff51ce4ee20074999527b19fbf280a8caa7db0bde957704033b6f5b330
- MD5 91f11a9181583f75e2b29fcd9050c7f5
- SHA1 fd90abc3048f3347435dfbd1075b8051ac6ffabc
- SHA512 925ac2a87e436219e22a924f615669cb166e8183d6e4dd0f00ed68c16faa3ffa10ab410106a7f81320f10205415bff9d10976f1dc0bb695b9293b80101e4ce8a
- SSDEEP 6144:CMgpxyZ5V8fTykwI08pCYixK53Ypm8I/yaNrm44tnePe/FkUCd:C1pxy+TyRd80YYDIn4NQvU
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15
- Target
  libGLESv2.dll
- Size 6.7MB
- SHA256 b49922f98946952e96c03c468a4812e0b1e7a090f4e1f96489f48acc07eba1f8
- MD5 16deb84c2dd1d55ed938a112b6ce92d4
- SHA1 15ed353f418030e2a3d94c2c77d45605ea9cb3c2
- SHA512 bb9ea90e01ac7e633d3e27054206c6070b352cce196b7b70b989af2b718dec3506d3aaf62e3074fdc93e7e23839ed15ccb8a508305170e7ba38920ca21f4047b
- SSDEEP 49152:UYwyKtMlbopeVIFTp22asNOy4vvzlqaip5QAW3JsGVi2W2/pU/vIx4LwlcwsSV/r:seVIFN2pnypWPFQq0yTdhVOrH7O5pm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16 behavioral17
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  swiftshader/libEGL.dll
- Size 449KB
- SHA256 711cf342b3a008c9116f6138358a67007a29d281d09cf23d20a5e17aa503ee9b
- MD5 29ae8bef0cf8b6a26f4bebc5a20900da
- SHA1 515abe76943288d531b35c1b4c764d1dbdb281db
- SHA512 99981e7074b580ace154c36d0aa1542dcdb979f36476b680ef19c3fd8a9126b5a808e6e1cf2224d20ba22c328b9a621c280c4ffa74638e358297809001d737ad
- SSDEEP 6144:WXs0JzgsBJ3fFhPLAdis2TQS39tSgpZX01Wofw4HQlyTztmK8G:zKBJPFRLAHitzZX01WcTztj8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20 behavioral21
- Target
  swiftshader/libGLESv2.dll
- Size 3.0MB
- SHA256 a97834a44a1e28b574c967f1cb93b97cd19e26616439133c11c9dda4b26d605b
- MD5 dc060f0be506dc5b48402c2ffd62c3a1
- SHA1 3988bb810d92b2e317767f8e25d3d1e43f0a6f68
- SHA512 04cf84033462a521c45b71f31ab007f712c6b2f5cfbfc97ce7dbf60074d525933af6388d9ede366a00a0983ba4e34a1b318a759cfbbb520ed621df9979bb315b
- SSDEEP 49152:P/CZxwhAhRPF/CA5cEK0mEVDTQc8F3Hn0Ha0nHzlJvOXkpNQkcXTVf4/NOmQrR4L:P4wHTccVfZ3nuV
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral22 behavioral23
- Target
  vk_swiftshader.dll
- Size 4.4MB
- SHA256 c64b87d7cebdaee8b779859059a6c63fb47c8102a4f7311d678895f87b825c59
- MD5 6b40ce4af617399536d0ea6edc84baad
- SHA1 55c91309fe49af121dd3de9c24f60b8cfea680f1
- SHA512 9c4caddb2f6ba7d17683d662a1d9ecd2efcdf1fc081e0127260f0266eda78b42c684bcad5bccbdc03a06619b9ae4960ccea67472d7650c53e67a5a70be6e36c6
- SSDEEP 49152:IF1AR5iHc7pcVZmoUAw2OtlWBLl0xmqOPAbbtCtZTK6pqFqP5z+PF/XL+j4aCyAj:BdVxA85dOj4/R
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral24 behavioral25
- Target
  vulkan-1.dll
- Size 830KB
- SHA256 6e8beb4e9da77313f40e75c4ffaeeaa522b6f054fd792631ec1efcf8248ca63b
- MD5 4783d34314ef4feb241f4fdf36499521
- SHA1 89296d6ac36cd005045db7307bf31005d0cf29a7
- SHA512 7ef1b0e89590b4af20f182bed9d82d5175d1c8c675fc3d05dc0eb2f834052124c877135fc68b2988683cf35e8b25870e45f7c126349d28125c021c8eeb4998ac
- SSDEEP 12288:t19hqUpfVn/HBSu5Eg14Jegb6m3vKzE/6oFXKQoEp7:X9hqCx5EgG6mSzNU+Ep
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral28 behavioral29

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects EpsilonStealer ASAR

Epsilon Stealer

Epsilon family

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

Epsilon Stealer

Epsilon family

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29