General
-
Target
(Purchase Order)file via WeTransfer.js
-
Size
1.2MB
-
Sample
220627-j2pnqabfg6
-
MD5
3279c93768fd176dfb0c7f471cfa848d
-
SHA1
87f5e39995bfe638dcf219522402840154ff931a
-
SHA256
121a8f68757adfa85c29dd26855049451df01724a67946e35915099bbdd494b2
-
SHA512
f016075eba8419540a071d68f99a01c9c9fda5e73344f4b7662fb60b6a60303d1cee25c90056e5445d3c4ebc5d22ff37af8a7b6badc02563189cd8001f8ae160
Malware Config
Extracted
eternity
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
Targets
-
-
Target
(Purchase Order)file via WeTransfer.js
-
Size
1.2MB
-
MD5
3279c93768fd176dfb0c7f471cfa848d
-
SHA1
87f5e39995bfe638dcf219522402840154ff931a
-
SHA256
121a8f68757adfa85c29dd26855049451df01724a67946e35915099bbdd494b2
-
SHA512
f016075eba8419540a071d68f99a01c9c9fda5e73344f4b7662fb60b6a60303d1cee25c90056e5445d3c4ebc5d22ff37af8a7b6badc02563189cd8001f8ae160
Score10/10-
Detects Eternity stealer
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
-
suricata: ET MALWARE ZHtrap CnC Checkin
suricata: ET MALWARE ZHtrap CnC Checkin
-
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
suricata: ET MALWARE ZHtrap CnC Response - Connection Successfully Established
-
Blocklisted process makes network request
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-