eternity

General

Target

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
Size

1.6MB
Sample

220725-2aa1csbchq
MD5

1e17d3a48a9af2ec606390be74a223d9
SHA1

71e47b7674ca15bbefa57d94ec8e39155085f571
SHA256

aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
SHA512

8b72687d93e23071ac62b4a873d351b3b7ce227811a49ae09b29cfeea3c7d987b34e233f30269a29c5fe2106c2f6f4c1c761cc24a8c872d6acc68c53146b8cff

Score

10^/10

eternity redline 4 @tag12312341 nam3 collection discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

nam3

C2

103.89.90.61:18728

Attributes

auth_value
64b900120bbceaa6a9c60e9079492895

Extracted

Family

redline

Botnet

4

C2

31.41.244.134:11643

Attributes

auth_value
a516b2d034ecd34338f12b50347fbd92

Extracted

Family

redline

Botnet

@tag12312341

C2

62.204.41.144:14096

Attributes

auth_value
71466795417275fac01979e57016e277

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Wallets

3d124531384b43d082e5cf79f6b2096a

Targets

- Target
  
  aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
- Size
  
  1.6MB
- MD5
  
  1e17d3a48a9af2ec606390be74a223d9
- SHA1
  
  71e47b7674ca15bbefa57d94ec8e39155085f571
- SHA256
  
  aba02213b0f3c686aa3b4a32104cc1b95748ff3ec926d3030cfb5b88a9b930db
- SHA512
  
  8b72687d93e23071ac62b4a873d351b3b7ce227811a49ae09b29cfeea3c7d987b34e233f30269a29c5fe2106c2f6f4c1c761cc24a8c872d6acc68c53146b8cff
Score

10^/10

eternity redline 4 @tag12312341 nam3 collection discovery infostealer spyware stealer
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses 2FA software files, possible credential harvesting
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2