eternity

General

Target
01f0f1f0ee4153c62a5d538217c9e4b5e714c67a6eb68d9c17ab595a0a658fef.bin
Size 882KB
Sample220517-nb4geabab9
SHA256 01f0f1f0ee4153c62a5d538217c9e4b5e714c67a6eb68d9c17ab595a0a658fef
MD5 4a8170905bbb4607bdaf7cb186e8b4f8
SHA1 172a2297a2b226c372b92ac2d07058417a71dd6c
SHA512 9d2acd7cb59d78e8ccffa8264bca58a9574bb2c0f23a15137355457fe971f79c927dcebc83fb77ab277881977bf523ca98038cda57ad255409b71914672aff74
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  01f0f1f0ee4153c62a5d538217c9e4b5e714c67a6eb68d9c17ab595a0a658fef.bin
- Size 882KB
- SHA256 01f0f1f0ee4153c62a5d538217c9e4b5e714c67a6eb68d9c17ab595a0a658fef
- MD5 4a8170905bbb4607bdaf7cb186e8b4f8
- SHA1 172a2297a2b226c372b92ac2d07058417a71dd6c
- SHA512 9d2acd7cb59d78e8ccffa8264bca58a9574bb2c0f23a15137355457fe971f79c927dcebc83fb77ab277881977bf523ca98038cda57ad255409b71914672aff74
- MD5 SHA1 SHA512
Score

10^/10

eternity spyware stealer suricata
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
  suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
  suricata
- suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
  suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
  suricata
- suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
  suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
  suricata
- suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
  suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
  suricata
- suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
  suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
  suricata
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects Eternity stealer

suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)

suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)

suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)

suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)

suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)

Executes dropped EXE

Reads user/profile data of web browsers

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2