MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dab1bc725537fd108f5bfab274982773c68e9ef8d14d3412495cbcfdf1f04f70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dab1bc725537fd108f5bfab274982773c68e9ef8d14d3412495cbcfdf1f04f70
SHA3-384 hash:	a7f50121ec384f0c2c1299bf996a95bd391080b01b2a159ac992a8c080f2c52f993b71e75092a81545d8e1965ed560ec
SHA1 hash:	0af9b23e1b3667d5f14403ec82ce2901ede6ff29
MD5 hash:	3133c80e73257392bf2a48532b334930
humanhash:	colorado-ceiling-mountain-jig
File name:	PlanetsBeta.exe
Download:	download sample
Signature	EpsilonStealer Alert Create hunting rule
File size:	74'823'917 bytes
First seen:	2024-01-17 13:46:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b34f154ec913d2d2c435cbd644e91687 (527 x GuLoader, 110 x RemcosRAT, 80 x EpsilonStealer)
ssdeep	1572864:w4/4rzOchPc4HXwwCpbfJdHYil6/MsLsBSEJ/10MwKztSWVkTl287:jkqcdhHnC5Rei/sLsBd/VwR/Y87
TLSH	T18FF73358ADCB34F7C03435F2B2F5655A340746035EF8E79198DA3A6EE06500AACF97B2
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	98e5676565a5a198 (20 x EpsilonStealer, 2 x NovaSentinel, 1 x LummaStealer)
Reporter	beansoup
Tags:	discord electron EpsilonStealer exe PlanetsTherapy

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

446

Origin country :

NL

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

control installer lolbin overlay packed shell32

Link:

https://www.filescan.io/uploads/65a7da5dfd5068bbc3d8cbdf/reports/355109ef-3f30-4e22-b621-126823c71fa0/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/dab1bc725537fd108f5bfab274982773c68e9ef8d14d3412495cbcfdf1f04f70

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Joe Sandbox suspicious

Result

Threat name:

n/a

Detection:

suspicious

Classification:

adwa

Score:

28 / 100

Link:

https://www.joesandbox.com/analysis/1376048

Signature

Drops PE files to the startup folder

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/dab1bc725537fd108f5bfab274982773c68e9ef8d14d3412495cbcfdf1f04f70

CERT.PL MWDB

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ky3y4svg76rbd237kzhjgbhopdi5hxy2fgtiesjls6p34pqj5ya._file

Threatray unknown

Verdict:

unknown

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

persistence spyware stealer

Link:

https://tria.ge/reports/240117-q3kjqagcdm/

Behaviour

Creates scheduled task(s)

Detects videocard installed

Enumerates processes with tasklist

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Enumerates physical storage devices

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.