Overview

overview

10

Static

static

2fe0a96562...18.exe

windows7-x64

10

2fe0a96562...18.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fe0a96562d37f562e983aa77cca5018.bin

  • Size

    830KB

  • Sample

    220727-am7rbabba6

  • MD5

    2fe0a96562d37f562e983aa77cca5018

  • SHA1

    93f2dd9d3cfdf6c1696c6b4091100edc3638bcc5

  • SHA256

    f4c69cc748d3614f1ac9a32db3c24f756532cb96ebe520344567fc0e29af93fa

  • SHA512

    d61ac67afca3c7ef1bd69dd1f4d218f0799654d2b3ead78a3857420c046d81d21107520d1a675a2cda85463e6d88a51e5c257ad344d1823ff37fc36a36179aa7

Score
10/10
eternitycollectionpersistencespywarestealer

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Wallets

3ee8c24dcb4849018bdb95dcef0c3a34

Targets

    • Target

      2fe0a96562d37f562e983aa77cca5018.bin

    • Size

      830KB

    • MD5

      2fe0a96562d37f562e983aa77cca5018

    • SHA1

      93f2dd9d3cfdf6c1696c6b4091100edc3638bcc5

    • SHA256

      f4c69cc748d3614f1ac9a32db3c24f756532cb96ebe520344567fc0e29af93fa

    • SHA512

      d61ac67afca3c7ef1bd69dd1f4d218f0799654d2b3ead78a3857420c046d81d21107520d1a675a2cda85463e6d88a51e5c257ad344d1823ff37fc36a36179aa7

    Score
    10/10
    eternitycollectionpersistencespywarestealer

    • Detects Eternity stealer

      stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks