Overview

overview

10

Static

static

10

Worm.exe

windows7-x64

10

Worm.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Worm.exe

  • Size

    1.3MB

  • Sample

    221125-zkvreagh5y

  • MD5

    d16f7b6510caf611ce85f0488ae0a65d

  • SHA1

    e7913e7dcdfc9be3a51bbd67a8e0e807b63bc33d

  • SHA256

    df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf

  • SHA512

    7d623007a1b80a2ec205d579104eca0ce7866501c7773c9298d4bed8790c7acc88a1eaabe5dbfe5b9d78d6934e58a6d88f5262a26316b47a6da74f09dcb79d53

  • SSDEEP

    24576:fgEdnkH+O5MMsj/8oJ0HOgwzMIdEyaXC772Q9NXw2/wPOjdGxY:fgEuHZ5MMpoJOp+MIVai7Tq24GjdGS

Score
10/10
eternity

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Attributes
  • payload_urls

    http://140.82.34.147/Client.exe

    http://140.82.34.147/Client.exe

Targets

    • Target

      Worm.exe

    • Size

      1.3MB

    • MD5

      d16f7b6510caf611ce85f0488ae0a65d

    • SHA1

      e7913e7dcdfc9be3a51bbd67a8e0e807b63bc33d

    • SHA256

      df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf

    • SHA512

      7d623007a1b80a2ec205d579104eca0ce7866501c7773c9298d4bed8790c7acc88a1eaabe5dbfe5b9d78d6934e58a6d88f5262a26316b47a6da74f09dcb79d53

    • SSDEEP

      24576:fgEdnkH+O5MMsj/8oJ0HOgwzMIdEyaXC772Q9NXw2/wPOjdGxY:fgEuHZ5MMpoJOp+MIVai7Tq24GjdGS

    Score
    10/10
    eternity

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks