MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35fa00f5cfff2ade175fbcec1e3af25c044870d660ee13decb6c16a57cf6ea8e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

EpsilonStealer

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	35fa00f5cfff2ade175fbcec1e3af25c044870d660ee13decb6c16a57cf6ea8e
SHA3-384 hash:	8e533d2a702696a16c9864cf4b8dcf77d7eb6e3fe35bcc86571ae967186c745993e3cb491df93e2e722b1eeae9bef097
SHA1 hash:	d8cf2e1d50c83c8ca4be00a42fc3226c897ba6b9
MD5 hash:	435720ce0a81d36ed8f489dd2b642a01
humanhash:	zebra-montana-oven-wyoming
File name:	CharowGamee.rar
Download:	download sample
Signature	EpsilonStealer Create hunting rule
File size:	65'102'290 bytes
First seen:	2023-12-11 17:47:16 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
Note:	This file is a password protected archive. The password is: charowbeta
ssdeep	1572864:FK9iL3EoaDBArZiVz4Uv1wcHufZefNE2HDWgK1Foux:k4LUoOiZiV0MmAyefHCgKboC
TLSH	T158E733D2BABDFF3A709E5A394DF82320C99CDBC3BC625631F4867AD35804259A453C19
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	Xev
Tags:	discordstealer EpsilonStealer pw-charowbeta rar

NIXLovesCooper

EpsilonStealer C2: wdb.life

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file is a password protected archive. The password is: charowbeta

This file archive contains 1 file(s), sorted by their relevance:

File name:	CharowGamee.exe
File size:	65'258'903 bytes
SHA256 hash:	d8afe991468eff73fa1c6cc6b166fb2652db4473a07f91ed2295d05923b01277
MD5 hash:	935ce02bcee8dc68f2d5da4ef059717d
MIME type:	application/x-dosexec
Signature	EpsilonStealer

Vendor Threat Intelligence

Gathering data

Verdict:

Suspicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/35fa00f5cfff2ade175fbcec1e3af25c044870d660ee13decb6c16a57cf6ea8e

Result

Verdict:

MALICIOUS

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gx5ab5op74vn4f27xtwb4oxslqceq4gwmdxbhxwlnqlkk7hw5kha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/231211-wn623afdc6/

Behaviour

Suspicious use of WriteProcessMemory

Detects videocard installed

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Enumerates physical storage devices

Looks up external IP address via web service

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.