Overview

overview

10

Static

static

cc9506259a...c1.exe

windows7_x64

10

cc9506259a...c1.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc9506259aa9686fbd60c19f178481d7a4ae4fb14c01c9d85990f5fe2838f2c1.bin

  • Size

    75KB

  • Sample

    220517-n79y3abec9

  • MD5

    8c4b137c90e1e658e26a9f7d583a6ae5

  • SHA1

    5597377685c0649a0c6355b28b6c01a0e5a57f4f

  • SHA256

    cc9506259aa9686fbd60c19f178481d7a4ae4fb14c01c9d85990f5fe2838f2c1

  • SHA512

    c2d49fca4de25b559abb80f63fc34151bb484a4e3027a3a19837b71239e41ec0d2f7e249e6ca5108229f88a014bcba5858a5052fa64ae39c8ea64b9c1ba7ce77

Score
10/10
eternityclippersuricata

Malware Config

Targets

    • Target

      cc9506259aa9686fbd60c19f178481d7a4ae4fb14c01c9d85990f5fe2838f2c1.bin

    • Size

      75KB

    • MD5

      8c4b137c90e1e658e26a9f7d583a6ae5

    • SHA1

      5597377685c0649a0c6355b28b6c01a0e5a57f4f

    • SHA256

      cc9506259aa9686fbd60c19f178481d7a4ae4fb14c01c9d85990f5fe2838f2c1

    • SHA512

      c2d49fca4de25b559abb80f63fc34151bb484a4e3027a3a19837b71239e41ec0d2f7e249e6ca5108229f88a014bcba5858a5052fa64ae39c8ea64b9c1ba7ce77

    Score
    10/10
    eternityclippersuricata

    • Detects Eternity clipper

      clipper

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • suricata: ET MALWARE Eternity Stealer CnC Domain in DNS Lookup (wasabiwallet .online)

      suricata: ET MALWARE Eternity Stealer CnC Domain in DNS Lookup (wasabiwallet .online)

      suricata

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks