eternity | e25764b0ea474f65afebe0b329796bcc90acbfaa4229eadff6ea30089a3ceadd

Analysis

Target

81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe
Size

241KB
MD5

90257b4f1de0e70235b2ff7419803afa
SHA1

60cebe074e8303abf2c344a99c2e83bad5a0d9c3
SHA256

81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649
SHA512

911067cb96914b5ab6e23864b316a0fcb686a651f50f1c0fd4731d7bfb36a12ff2f95bcf42bf2866d9d6265b7b21b2aaf33fcb3ec7c63e123fffecf89e59952d

Score

10^/10

Family

jester

Botnet

FikusCode

http://jesterdcuxzbey4xvlwwheoecpltru5be2mzuk4w7a7nrhckdjjhrbyd.onion/report/FikusCode

https://api.anonfiles.com/upload?token=d26d620842507144

Mutex

46378331-3729-449c-9a03-94f385d10a9c

Attributes

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3840-130-0x000002038FD30000-0x000002038FD72000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Jester
Jester is an information stealer malware written in C#.
stealer jester
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe

description pid process

Token: SeDebugPrivilege 3840 81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe

description	pid	process
Token: SeDebugPrivilege	3840	81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe

C:\Users\Admin\AppData\Local\Temp\81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe
"C:\Users\Admin\AppData\Local\Temp\81fcca2ba4b2af6081ff0291f7e5221ed811549b2b5e27e9456e19ed8f71c649.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3840

memory/3840-130-0x000002038FD30000-0x000002038FD72000-memory.dmp

Filesize
264KB

Download
memory/3840-131-0x00007FFB69B10000-0x00007FFB6A5D1000-memory.dmp

Filesize
10.8MB

Download
memory/3840-132-0x00007FFB69B10000-0x00007FFB6A5D1000-memory.dmp

Filesize
10.8MB

Download