General
-
Target
HEUR-Trojan.MSIL.Miner.gen-456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f.exe
-
Size
2.6MB
-
Sample
221228-k9zpbshh54
-
MD5
70c8fd30453ae4f4e415dc6656d3cda0
-
SHA1
c6c2ad6cbb19c422463930f74352bfbb5617d6e5
-
SHA256
456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f
-
SHA512
3967693cca9e917e7c41eae6c4159960268df91102d402fc72eabb46305d8e1b036251c558922e9b038c2a9ace679940a8689df24d24a7632d4d6cb400bdb879
-
SSDEEP
49152:5lIWlkJd+Zx0ymR8S/gXU0AmDyDoHkFVoGdrZXThSoRBABX63z:5lI4OAx0y8VEYmDy8HkocrZ746j
Behavioral task
behavioral1
Sample
HEUR-Trojan.MSIL.Miner.gen-456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan.MSIL.Miner.gen-456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f.exe
Resource
win10v2004-20221111-en
Malware Config
Extracted
eternity
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
-
payload_urls
http://111.90.151.174:7777/Ransomworm.exe
http://111.90.151.174:7777/Ransomware.exe
Targets
-
-
Target
HEUR-Trojan.MSIL.Miner.gen-456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f.exe
-
Size
2.6MB
-
MD5
70c8fd30453ae4f4e415dc6656d3cda0
-
SHA1
c6c2ad6cbb19c422463930f74352bfbb5617d6e5
-
SHA256
456d2a29b452753922602528327eed8b96978d80860ba148bbfb4aacfb553b4f
-
SHA512
3967693cca9e917e7c41eae6c4159960268df91102d402fc72eabb46305d8e1b036251c558922e9b038c2a9ace679940a8689df24d24a7632d4d6cb400bdb879
-
SSDEEP
49152:5lIWlkJd+Zx0ymR8S/gXU0AmDyDoHkFVoGdrZXThSoRBABX63z:5lI4OAx0y8VEYmDy8HkocrZ746j
Score10/10-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-