General
- Target jaffacakes118_QuietForest.exe
- Size 62.6MB
- Sample260921-3s47labd77
- SHA256 5e35d02644c08098d75cb75eb8751ed2fe9f64d2979c74b945b801c68bfdfa4e
Malware Config
Targets
-
- Target jaffacakes118_QuietForest.exe
- Size 62.6MB
- SHA256 5e35d02644c08098d75cb75eb8751ed2fe9f64d2979c74b945b801c68bfdfa4e
Score10/10Family: Epsilon Stealer
Information stealer.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 5.3MB
- SHA256 501f0b7ebf0be7ed8702d317332a0f8820af837c0a2a1d7645ba04352270e2b8
Score3/10 -
- Target d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
Score1/10 -
- Target ffmpeg.dll
- Size 2.6MB
- SHA256 4abbed23bb74732b021b31ea3881efeb94af14d00d98a8c795359acf8d72b3ec
Score1/10 -
- Target libEGL.dll
- Size 437KB
- SHA256 02206307397bb252efcdbe0792c85183fd04b225b1efa986d7636297fbef3205
Score1/10 -
- Target libGLESv2.dll
- Size 6.7MB
- SHA256 d1cdb910bb1d7c59611eec613c1d12414dfc4b69013daeff6d9e0b9ac10f5f60
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target swiftshader/libEGL.dll
- Size 449KB
- SHA256 6d24ef2dd27e80f898e5e3569db01229b94336641944c9456daebd8f3991cff3
Score1/10 -
- Target swiftshader/libGLESv2.dll
- Size 3.0MB
- SHA256 bb055375ebafcc890d4a86af3609d74b2836b6770af28570c531f2ee28db6bd2
Score1/10 -
- Target vk_swiftshader.dll
- Size 4.4MB
- SHA256 11502332052b730ee985c3f0aed8dd38eccc068030d61b6bf69660b954d86f2b
Score1/10 -
- Target vulkan-1.dll
- Size 830KB
- SHA256 79601e7917850f7fde72b2f2785cd0daacd2fe68aa0cfb4050dd01988794e5e1
Score1/10 -
- Target weqweqwvdafhgdsadas.exe
- Size 140.1MB
- SHA256 a70f479126204427f1480146de08c8bb5d18cf0a4e4aeb2b1d34fe44b841f556
Score10/10Family: Epsilon Stealer
Information stealer.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
3System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1