e818d461b40491fedea4982f7717de7f1fdc44437db2a7c5ed2af25d5797155c

Sharing

Copy URL Twitter E-mail

General

Target
Empryo-3.5.7-beta-win-x64.exe
Size 219.1MB
Sample260804-jfprlathkg
SHA256 e818d461b40491fedea4982f7717de7f1fdc44437db2a7c5ed2af25d5797155c
MD5 87375677dc7151aadd32342db5e0bfe1
SHA1 b271231670cb45bbbe3d3a3f2674c73aafe1a9dd
SHA512 8332ff5768ef439f4c5ec584598487b6da9a29b107d145bbd6b2e7fc3a16fefc98834c93e73559d93b79ad0f8b3425af16d533ae40a58f09442f3882730d8daf
SSDEEP 6291456:oUcTFOrgfIgMm1YzFgmbckEmOxcE9gYEbI/PQmHlZHG:DcTFq1gM+W3bcb5cEhEU/omHlZm
TLSH
T12DB833253DFE679AD6012B310728DF741A952EA41C86B2810CC4FEFBF9FE4E24957216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Empryo-3.5.7-beta-win-x64.exe
- Size 219.1MB
- SHA256 e818d461b40491fedea4982f7717de7f1fdc44437db2a7c5ed2af25d5797155c
- MD5 87375677dc7151aadd32342db5e0bfe1
- SHA1 b271231670cb45bbbe3d3a3f2674c73aafe1a9dd
- SHA512 8332ff5768ef439f4c5ec584598487b6da9a29b107d145bbd6b2e7fc3a16fefc98834c93e73559d93b79ad0f8b3425af16d533ae40a58f09442f3882730d8daf
- SSDEEP 6291456:oUcTFOrgfIgMm1YzFgmbckEmOxcE9gYEbI/PQmHlZHG:DcTFq1gM+W3bcb5cEhEU/omHlZm
- TLSH
  T12DB833253DFE679AD6012B310728DF741A952EA41C86B2810CC4FEFBF9FE4E24957216
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/app-64.7z
- Size 218.0MB
- SHA256 d8e7ad9562dac7f150841f6756a936d66363ae093e0558b2b08a6a2762c39c8e
- MD5 1117350062ae280a7c11ab258921de4f
- SHA1 4b9cc06fa0274ff9e900ae8c9cc0647ead5d7a68
- SHA512 27860c7453e68f64ceb6cf8aff4816fb5419531754d65d439d880f0a60a75e4f07c6db7a903ba9763dd351ca867c1ba60a9e23be24beca32bfcf9be5cdd4920c
- SSDEEP 6291456:8UcTFOrgfIgMm1YzFgmbckEmOxcE9gYEbI/PQmHlZHE:/cTFq1gM+W3bcb5cEhEU/omHlZk
- TLSH
  T176B833397CFE27992B416751033CCF881DE629B5488772900884D7FAE9FC4F54A9B62B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  LICENSE.electron.txt
- Size 1KB
- SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
- MD5 4d42118d35941e0f664dddbd83f633c5
- SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
- SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63
- TLSH
  T1B511861E726453721C56136055766C84F12F725FBAAF2784246EF384233746CE5FF844
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral13 behavioral14
- Target
  chrome_100_percent.pak
- Size 117KB
- SHA256 d76fe8fa3a14cd73e4c858746e2ab2d2fa6f2df38a906fa5814b50a8a895fc96
- MD5 37c48e66c39832d32fa2e926ac503c4a
- SHA1 2400135b49193c9786f1faa8d00169ce3d38ca98
- SHA512 e1b631c3834fb84e96ab9fe44b12a8fa6c6b3c767e00a17ed8c3d8f8fbe7bc2dfe83fe33e7aca4f32439bdbad21d25af6b9e263d412922e40d09d4e421f12941
- SSDEEP 3072:Kw4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:UYWFUbGz8LI1TdjQBQCrC
- TLSH
  T19AC3E0E773B0AD7DCA464BB743560070FCB30B2D06C2170A4A9AE479652AF98D9D93D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral15 behavioral16
- Target
  chrome_200_percent.pak
- Size 192KB
- SHA256 b74ad439f3d3762657f3ba533a6af3ac63315c838ed46519891366f43d834a0e
- MD5 e6a75313c720a6ebe3182b4e1db48328
- SHA1 d60a503cf4604c816d9146d7fe4041018d445888
- SHA512 3c8699b998c53c0414933ba18e0cf561488b9e209523a9b4093b68d38393e9a6bc683cdffc32a8050be25b473153b71743acf9c33f070166f1e15f2a453e8eb4
- SSDEEP 3072:+FJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:+IGQ+N6uSZQDQYakvyAk9jQBQNd4
- TLSH
  T1D01401D723B4AD3DDA530BB3A26710E0FD7A20291EB3514A569FD8397925E88C9CD343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  icudtl.dat
- Size 10.4MB
- SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
- MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
- SHA1 18ff020331534d21f24d922d4da3c253668e44d8
- SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
- SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
- TLSH
  T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  locales/af.pak
- Size 599KB
- SHA256 dcf39c3edbb6b0a625baee0263a9b426eadd1a6d1bfbf03a209501a18bc4b0e4
- MD5 f351564453e36318d0442e29db7bd5c2
- SHA1 d8dbe32c5656468b4f96a799dc7de3bab37b41e2
- SHA512 07050f6b0c484d07b345200fdc6d2394201d3d1befa7310d15decfa2e67ed27724c53da2175148588f27822f28b31dff75e44b99658c141392e08a7d8be82789
- SSDEEP 12288:ayyCh2E1FPQ6tRGtAM9q+ZRwBgNYChF+plGnVbi4H2JynDNsmpiALjKrFozv2nIX:nmyPftRGtAM9PZRwBgNYChF+plibi4HV
- TLSH
  T112D40A0BEB81173D09A06697FB0845B7FB5D626CD770B2BADDA982310966DFC10BD0D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  locales/am.pak
- Size 971KB
- SHA256 b1d444f2346105a6e15f9b14fc5653e1edaa2b435290fb8f1238347a4d4ca8f9
- MD5 79fad5635b13538c17b92b87df28ac9e
- SHA1 81e142d7dd601f69d2f9b8c63b998adc926e8286
- SHA512 3158dd5daaf08933549694bf952ebcc14c3db91afc2fac3a942b8d1d30892ab57e4dce966dbaa7dc323c2deca1f1145e7517be25020b48a2ea9bf7f7de5575d2
- SSDEEP 24576:LtXGVoTx1A5t7hTCKPyaEVxsxHjnwvxehz/dIXV6sciy4VdeZtP9oPYOH+:LBGVr
- TLSH
  T13225AA547EF9F7570F8E8A1994320E4E9594AE4652802C38C35AE3FC2B2DF1B4DDE219
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  locales/ar.pak
- Size 1.0MB
- SHA256 36f46452c3becb64e1034a6e69286cb5e91f98593c81511c79176f1cc560e159
- MD5 9a943e98366a7294b2576cd8af68b1ba
- SHA1 95808bcd45a52611f1557d45709a0dce57e500a7
- SHA512 51dee58881fed2d989e1fe2e5bd32a52659a2c889a4ebd8dd075561a74052db5cb6b3c139bf65387b624d76754e68c7864f0da24199fd9c30060caee63caf12b
- SSDEEP 12288:1yWqo8bA8BmdpLFB62Ga9mwj3o0oCbv4UGPFk82/SLZNj6EuDb6NPz:1Ko8bAdEr
- TLSH
  T142358AE21B2984720B56DF0FD1E23668E872BD23DB4BFC3124934A2156D7513E78E678
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  locales/bg.pak
- Size 1.1MB
- SHA256 e4a5bea23a26a06af611a7cb518b22a1d53ec5df45a6322f0e264b99c7318441
- MD5 077df43e5adc6bf502d5bbf057a0afe5
- SHA1 6e608c0a0f3a3e19f63840c35ffc7d8c7dd0cf47
- SHA512 b1996aab50923361c352acfd92c177d53e2336656e6ee29312227e685bf3d1202336ec51c9b757752b199f2c69a4d5185a5db05a600fe5b26f145e58da4191dd
- SSDEEP 24576:81oSpWclYLYAgCzQkECRUPVb6nNo7j373ZKmiv3p1K4UfVDiiJw74uOVnaJcuSMQ:5SpWclYLYAmUUPVb6nNo7j373ZKmy3pG
- TLSH
  T1B83525A15B9A689F0101F45F98087E093CEB84FE3FE7879241652DBD39F10B487BA64D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/app.asar.unpacked/node_modules/electron-liquid-glass/dist/index.cjs
- Size 3KB
- SHA256 90101f3b6a66ed19944bbff5518f0ae6a61eeb73763731936f7e425beddf2595
- MD5 4e16df59c48d8032b9e9464c2e864a02
- SHA1 81c4f8ff1fcbde30f0ad7c76ee15a1d3f02c6118
- SHA512 2df321ceddacb3ac2be709a78fa8eba597b458414b4e08df9283c89a888e12e4c3f41d1a5bb938d0eee011f3135591880a8ebe9998084336d006987b8bfc5837
- TLSH
  T19481B6D092727926626220DBB43C8A43373DC6B6B111D929CDFC07DCA2CA05AC696D72
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral29 behavioral30
- Target
  resources/app.asar.unpacked/node_modules/electron-liquid-glass/node_modules/node-addon-api/index.js
- Size 435B
- SHA256 afbfa96b5c40c643828f212610129d2911095eff1e86e63ccfe81658d6fe61d9
- MD5 30ea0badd4204d9a347f3407a65701d0
- SHA1 40dadbe955e32b07123efd8d34667ef620a3e3ed
- SHA512 cf472b879b1b5d45cc8f696bd4d786debd8cdc75a294552e87fb5fefbd75f88a9cdfb736c9f08767c8926ca5bb9e8f8a6e8675aca2da2e24c5e3876dc11b6367
- TLSH
  T175E0AB2A69FC1135AC02CBA0F7C089121D8DF1B2BB4529C4C5992DC0FD4FCC41227CC8
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32