MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ded2a6e3b34dc384a6364c393b9610d947dca0d1a37a90541fc47f70f173e35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8ded2a6e3b34dc384a6364c393b9610d947dca0d1a37a90541fc47f70f173e35
SHA3-384 hash:	f686d7f667fee732ab9ea25151ff2424afa50b99eeb2bd8c7717c5c2302a506fe25a62d9c1407afabd9e41ef9ad6d382
SHA1 hash:	56d33f5e139bf83d8bb88ee6ae14ddb9346856da
MD5 hash:	65ffc153e1c284f8a577e728296f6d81
humanhash:	south-six-pip-california
File name:	WhispyProject.exe
Download:	download sample
Signature	EpsilonStealer Alert Create hunting rule
File size:	64'794'978 bytes
First seen:	2023-11-18 19:45:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:9m6YxMrHPl+JUOV1ZN8ukAjqeEP7BRvaJBfzIyU1t7:Q6GqHPlulRN8zMq/DrvanfzI37
TLSH	T128E733CAF815802BC0659AB3E419CBFBD7E167896B11C7831F38C7B9AD4256A0F019DD
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
dhash icon	100c3232b2b24c30 (38 x EpsilonStealer)
Reporter	Xev
Tags:	discordstealer EpsilonStealer exe

NIXLovesCooper

C2: wdb.life

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

340

Origin country :

GR

Vendor Threat Intelligence

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Searching for the window

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Creating a file

DNS request

Searching for synchronization primitives

Unauthorized injection to a recently created process

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Changing a file

Sending a custom TCP request

Running batch commands

Creating a process with a hidden window

Launching a process

Using the Windows Management Instrumentation requests

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/6559147de7421d316a442ebf/reports/de26a940-113d-460f-ae5f-cdabc586b3c5/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/8ded2a6e3b34dc384a6364c393b9610d947dca0d1a37a90541fc47f70f173e35

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

spyw

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/1344593

Signature

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/8ded2a6e3b34dc384a6364c393b9610d947dca0d1a37a90541fc47f70f173e35

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-23 22:04:32 UTC

File Type:

PE (Exe)

Extracted files:

138

AV detection:

5 of 38 (13.16%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rxwsu3r3gtodqstdmtbzholbbwkh3sqndi32sbkb7rd7odyxhy2q._file

Threatray unknown

Verdict:

unknown

Hatching Triage epsilon

Result

Malware family:

epsilon

Alert

Create hunting rule

Score:

  10/10

Tags:

family:epsilon spyware stealer

Link:

https://tria.ge/reports/231118-ygy4zsfe22/

Behaviour

Enumerates processes with tasklist

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Looks up external IP address via web service

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Detects EpsilonStealer ASAR

Epsilon Stealer

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.