Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aebfa3cedc1b200217c1f128b1a1d248138b563533f5747225b1fbc1218190bb

  • Size

    334KB

  • Sample

    221112-d1kqgsgf2v

  • MD5

    f8b8ce8be51013388ccee45aee77d692

  • SHA1

    3437212f5920cdc908fddcf0a6ca413d29829a22

  • SHA256

    aebfa3cedc1b200217c1f128b1a1d248138b563533f5747225b1fbc1218190bb

  • SHA512

    be714d4a546682335454a7f2cf0918831b153abf0d9467ce9845e8dcd7867bba32e108bf66225632df8b544bc9c05685cf00be6c33e5c7f52e3f959537c10e8b

  • SSDEEP

    6144:l2DvsaWhaQkFcEhXsnz36zARQpgcGLNB7DPEPjabJNCZID52:l2DvsaW6WWnYNB7e3Zo5

Score
10/10
eternitycollectionspywarestealer

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

    • Target

      aebfa3cedc1b200217c1f128b1a1d248138b563533f5747225b1fbc1218190bb

    • Size

      334KB

    • MD5

      f8b8ce8be51013388ccee45aee77d692

    • SHA1

      3437212f5920cdc908fddcf0a6ca413d29829a22

    • SHA256

      aebfa3cedc1b200217c1f128b1a1d248138b563533f5747225b1fbc1218190bb

    • SHA512

      be714d4a546682335454a7f2cf0918831b153abf0d9467ce9845e8dcd7867bba32e108bf66225632df8b544bc9c05685cf00be6c33e5c7f52e3f959537c10e8b

    • SSDEEP

      6144:l2DvsaWhaQkFcEhXsnz36zARQpgcGLNB7DPEPjabJNCZID52:l2DvsaW6WWnYNB7e3Zo5

    Score
    10/10
    eternitycollectionspywarestealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks