d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a

Sharing

Copy URL Twitter E-mail

General

Target
UpdaterSetup.exe
Size 29.2MB
Sample260805-w11e2stcnd
SHA256 d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a
MD5 6f095eab04a3f52fd97161ea4b8c4db7
SHA1 de9cbf1006e690b4eb2987d0a45a84b6bf3c700b
SHA512 7fec84c6358492beb809b9e907625157fe33d8758c348baa90f637c0251bd9934973b5a12ddf4cda73757ffeed0d596fc427e6a7571ac7a05712168049b30910
SSDEEP 786432:U0ay2tMT8mWDACjI421oykeL0Z40kB0kPel8Z6yiMtx:U0ctYHXCE4qLuZxkiK
TLSH
T10E673326F318C716C84354328F9BB65947947E3AED5588B5EB443B1EEE7A083823C64F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Targets

- Target
  UpdaterSetup.exe
- Size 29.2MB
- SHA256 d2cb2b1b89dfeb565e0ae3ed1cba7d00186eadf3820f330cf03d0bb4231ac61a
- MD5 6f095eab04a3f52fd97161ea4b8c4db7
- SHA1 de9cbf1006e690b4eb2987d0a45a84b6bf3c700b
- SHA512 7fec84c6358492beb809b9e907625157fe33d8758c348baa90f637c0251bd9934973b5a12ddf4cda73757ffeed0d596fc427e6a7571ac7a05712168049b30910
- SSDEEP 786432:U0ay2tMT8mWDACjI421oykeL0Z40kB0kPel8Z6yiMtx:U0ctYHXCE4qLuZxkiK
- TLSH
  T10E673326F318C716C84354328F9BB65947947E3AED5588B5EB443B1EEE7A083823C64F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/DotNetChecker.dll
- Size 84KB
- SHA256 39c43d67f546fc898f7406d213b73dcb1bc30fc811ddfa3a02b6b50c29d11f91
- MD5 f18364fa5084add86c6e73e457404f18
- SHA1 6d87c4b9dbf78af88fddf0d4d5febe845c8e4e6a
- SHA512 716892492390fe4314f3289286f733d07b8b84de1f5af0676b26e68c0be01808682d35ad2bb9e9491247b7bb5a0ea297a6850e26de9baf88621c789206107db3
- SSDEEP 1536:AZBjgSXlkq8su+OudgGpGlmQSMqJS4HGsorJKQUDs0OsWPIcdGbk2HeJ:AYvo7PMqEuiKQGbk2HeJ
- TLSH
  T14D835B1076D0C1B5E57F1D3948A6D661076EB810EFE4CDEB279A03690E702C1BE3AE23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsisdl.dll
- Size 15KB
- SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
- MD5 ee68463fed225c5c98d800bdbd205598
- SHA1 306364af624de3028e2078c4d8c234fa497bd723
- SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
- SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
- TLSH
  T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $TEMP/vc_redist.x64.exe
- Size 13.9MB
- SHA256 5eea714e1f22f1875c1cb7b1738b0c0b1f02aec5ecb95f0fdb1c5171c6cd93a3
- MD5 27b141aacc2777a82bb3fa9f6e5e5c1c
- SHA1 3155cb0f146b927fcc30647c1a904cd162548c8c
- SHA512 7789eabb6dd4a159bb899d2e6d6df70addb3df239bda6f9ead8c1d2a2ac2062fce3a495814b48a3c2bec12f13800ad0703e2c61c35158b0912011b914f098011
- SSDEEP 393216:xTPq5dCsKSR65cX7Eyd/qnejOX3L8T8KYfU3j:VP5iw56oyleejcL8T8fc3
- TLSH
  T131E63332E6644227C6D30973ED65E2246EBCA22D7F108476C784AE1DBDAC4D393B7217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  $TEMP/vc_redist.x86.exe
- Size 13.1MB
- SHA256 fdd1e1f0dcae2d0aa0720895eff33b927d13076e64464bb7c7e5843b7667cd14
- MD5 1a15e6606bac9647e7ad3caa543377cf
- SHA1 bfb74e498c44d3a103ca3aa2831763fb417134d1
- SHA512 e8cb67fc8e0312da3cc98364b96dfa1a63150ab9de60069c4af60c1cf77d440b7dffe630b4784ba07ea9bf146bdbf6ad5282a900ffd6ab7d86433456a752b2fd
- SSDEEP 393216:S1RPq5dCsKSR65cX7Eyd/qnejOFxP7OEnl4L/Vvc:yP5iw56oyleej2OEnlwc
- TLSH
  T189D63336A3648126C5E30573EE15E1206F687329BB1488FBD3447E1D3E69587A3BB34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  AdvancedWizard.dll
- Size 56KB
- SHA256 28210f870f3ebdb877b1e58441c04bb48c8a1899da76931502c6e7d6f20b7197
- MD5 2e75047db0e3bab50fd6c89bac700a8d
- SHA1 fcf0d87631abe89b52e934cf3c02cff06ca152c4
- SHA512 33c255c197d96d972b0a4febd4ba19f5532593a5e0754913403756fedbcf8cb95bd8fd8a8e0af846ccda8110f32f6f11016feff23c6f253708c5f010c686ea65
- SSDEEP 384:jgWd2pLZsCTnFUYoP2iYgk7c+UMvoV6jqsC/2cXmA9C2T1izlzlzlzlzlA9qbOEs:vc9oIqsOm2TtMrMi6er18DPcnMBC7k
- TLSH
  T18B430911B778AB37CBAA1AF47C59525003B5D252BA51EBDD0C44A0DFE8C37138B636A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  DataGridViewGrouper.dll
- Size 125KB
- SHA256 5253dc41c0f58ba00294a2fe9a2501a5e6b104423da2d6f0e465f5f26e9aa775
- MD5 2038a9f0643103a006c7aadc64c3d6cb
- SHA1 68929981c62ee0c217afa7135ba7f4a3a7b6aa4b
- SHA512 fe2e241247cab801a1b415c78ad1d8745ef3d53815527e46c9936d0aa3a8d19f983871abde63fc21baba0dcc937b199b7fdbebd71173d26eec0aa1bede312065
- SSDEEP 3072:Ibs+hUu5sphOrvYxBIZmG0ngRK4I9vYF9hCjmcosGwOEw1dWrXsFqeL3HAVO7:GUYspvmcosGuw1ArXsFqeL3HAVO
- TLSH
  T173C31A2816E84B27C5AF0BBDF06145148371A262E683F77D5A88F1F81C77750DA923AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Epsilon.FileServer.dll
- Size 41KB
- SHA256 d788437fe76b716f5485aacfba82f18e99d5e56681270d90a9e4c1e0198e8cf4
- MD5 9758732f072c838b885f593d70a2569c
- SHA1 39773d8d7fb8264525a9469c92e208af89481aba
- SHA512 192b6d1b3576e580848e36a6178b6587a5182ea2a57bfbc69be81457f94d3d633fac2a416a708714f0bfadebaef909a5819c52bda147a478d3f71d69f2ee45c2
- SSDEEP 768:gdmvoTaQopC5B5f2hyayJGdetXLBoZ88hgeEVG/ncs5AgR:cmvomNC5BWyAOXqZ88hgYPNrR
- TLSH
  T18A13FA4977ECA211E1AE5BB944F22114437BB9075633E30E1ECE60AA1E337D58A10FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Epsilon.Updater.Install.exe
- Size 27KB
- SHA256 976ab0de3eb1754230e6cb1fe49bddc55cdd48da0553745a1bc9ca2e959e32af
- MD5 185924800e6d6c7e804562f19a4cea83
- SHA1 efb53cb8366c2068d844c477433478584e823da2
- SHA512 a60121ef1dfb4e480909ee4387d2b87daa367ed738bc3c2123e42aaff8949eb5f4ccacbf1f55cfd99cc0ed6399b95860126546df1ce684836a6c9c7e3071d2a4
- SSDEEP 768:oeil5hX9Eh3SEBtYcFSVc6Kaw/Hz3iPmbL0o:oeilDahCExSVclaw/Hb7so
- TLSH
  T186D27C423AD01271D9EE4A747CA74722CE31B7A37925864B34EC454A5FB27C493236AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Downloads MZ/PE file
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  Epsilon.Updater.Libs.dll
- Size 273KB
- SHA256 fd0198644db645a44f4118d63edbdc4c2b60b2d2d9ad38c2a0a1bb2bc697e5a6
- MD5 6945f66f7dc9ba8c2c7a12482e2af386
- SHA1 f15d0fd0b517daf1d466794c2a29dfd433ed3f29
- SHA512 f9497c8e9233dbad12b32513e331ff290d2424b1e0dfb3cfb9d5e2225c90feb8ec1e260e65aac28a532edef45ca6b4e5b332cf0d1a5115b4faf06c453efb81fc
- SSDEEP 3072:mIYauGGiNiSPnMYEGV3Hz+rcOKnkHecsbMDfgtpKNK3zxr+K8rHh+Hqel9/2Rodg:mPBiNiRYvHSn47J6KjxrO4Ke4CLk/mK
- TLSH
  T19A548F3C63FC8B71C6AF1FB8D111901443F4D25BB152E35D8E8475DC19637A2EA22AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Epsilon.Updater.Service.exe
- Size 30KB
- SHA256 1692fbf9e26db5449ed4245e3d082c3a5511f5640b66335001eb350823b3743c
- MD5 5f9795a3fbda5fff4eaa32df1c7c12b2
- SHA1 bddd592199da83a488942de9e228ce03d6cec3c5
- SHA512 75a2f77209f12be02c6a4fed07c481cef13a14dc2ba2107c82f8267ef4961fa5cea524eeb9b40c9a9042a2ff78da0b864e78419fb0248d6c79b701e471f1f335
- SSDEEP 768:0R33oOuSgj6EtYcFSVc6KRw/H3G3iPmbL3M:0R3Jz+64SVclRw/H347vM
- TLSH
  T1CFD28D4337E052B1DEAA0AB8B4B507124B31F7A33C268A5A75DC015D1FDB789931366F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Epsilon.Updater.UI.exe
- Size 1.0MB
- SHA256 12614e10ce4f2e366d78e84792132aa42aae3e820985ef8bc5128d0f409d3839
- MD5 e869c77cb71f72fdd6273860f0112cc3
- SHA1 15471fbb2595e0e0512d1ce868e93006b557bf47
- SHA512 2f776f451c53b099f3a33bd834b236ef70a8abb3583997eb4947e4f1b5a60a85ca347fb6bb94b62dbc106b6e729f059dbd81fb03841f97e1450c5f0745712a67
- SSDEEP 6144:BqaoojQqcC/hY/HFQ1FxwFvhXxukt+Mq9F0I6FQHq9F0I6FQoq9F0IkHXtqqKi7P:wiQV9QhwFaf30IU30Il30IvDi7P
- TLSH
  T1FB35A7213AAB414FD86A0770A835C1F443763E697A48DE4E94D43D4EFD722638B31AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Epsilon.Updater.Uninstall.exe
- Size 24KB
- SHA256 c1f4e12e42db7234447c48c3d835959cc7ab0f71d10c35560b3eac611e9177fb
- MD5 90c77e5aba09ce2ae4ff94ea629b0ed5
- SHA1 1f6f02a233060d9ded5d787ca70acddbc40655d3
- SHA512 714a13e346716cd75e3bfaeb2adf79c4513c70dd6452967ee3b9fa448f3f6bc79c4a756d7b11a3eda02c0a2d47137eabc7bff5b2169d322c904c8086edd43e2b
- SSDEEP 768:t5l2tHhUGtYcFsBE6Kfw/HHA3iPmbLLxE:3sUasBElfw/HHu7TxE
- TLSH
  T13AB27D433B902321CADE4EB9B8D982635A71F3732D25469D38DC819FAF12381572227F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  FluentFTP.dll
- Size 384KB
- SHA256 2671359f143600512d90a1540915ea3b5e85f5ec474927a2e18afab452f26838
- MD5 29c96e7e7d4234e346d0560f7220c1b0
- SHA1 5af43920ed0f828c647e03d2e6ad1fc17a8aba63
- SHA512 b94ff41b16bd892c73c4e3a2534defa55f3831cbbf7d06bcb9431f1ace0013007efae2fa42db174b1d7cd36339cdd7ba9d39369fc788769c62d6c582a7a7a469
- SSDEEP 12288:IRXRGR4RZRuRORxRORCRSRwRLRERLH9XiOxeLsXY1Em+pd2Rb1g4IWF8m74suMGj:5Sx
- TLSH
  T139843A5813ECAB06F2AF27F998749896D775B127D566F38E0E8CD8D92C13791C800B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32