General

  • Target

    beef91ad4f42aceb79f47d23bb4a4960.exe

  • Size

    2.0MB

  • Sample

    221128-janmcaeh36

  • MD5

    beef91ad4f42aceb79f47d23bb4a4960

  • SHA1

    383cf8953efab212fb70209d33c8a64cde1d04b4

  • SHA256

    0eba42728c9697c812859850862f10b66d3cec782fa093ad68b141148a8c9664

  • SHA512

    f68b6a695ed8ba06131a0cf0b727338781f01a45c2c6bc72cae717581017f6ae2239cdfffe2a712da26c15364561ea5ce84dd1e2466047b1ccb8db52e2362f34

  • SSDEEP

    49152:EvXknXuMsbfbSp7ibAYXzZJ/7V5vBLdKbtKeOX:EvU+LupnYXtJjFLd0T

Score
10/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    http://167.88.170.23/w993.exe

    http://167.88.170.23/s101.exe,http://167.88.170.23/101.exe,http://167.88.170.23/R101.exe

Targets

    • Target

      beef91ad4f42aceb79f47d23bb4a4960.exe

    • Size

      2.0MB

    • MD5

      beef91ad4f42aceb79f47d23bb4a4960

    • SHA1

      383cf8953efab212fb70209d33c8a64cde1d04b4

    • SHA256

      0eba42728c9697c812859850862f10b66d3cec782fa093ad68b141148a8c9664

    • SHA512

      f68b6a695ed8ba06131a0cf0b727338781f01a45c2c6bc72cae717581017f6ae2239cdfffe2a712da26c15364561ea5ce84dd1e2466047b1ccb8db52e2362f34

    • SSDEEP

      49152:EvXknXuMsbfbSp7ibAYXzZJ/7V5vBLdKbtKeOX:EvU+LupnYXtJjFLd0T

    Score
    10/10
    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Tasks