Extracted

• • Target

    Booking_026.xlsm

  • Size

    1.2MB

  • MD5

    f2736bb56b73534ce57add5454f42b8f

  • SHA1

    273d466b07ffb107b2579571be093dacbd12f493

  • SHA256

    ffb46e1539df5512e0710ea41370077f07eebddfb8e99033eba3fb1aefb04bc3

  • SHA512

    55ef2b0bd23f06e01d53b5f2056f61f94e96751d6340c3731f52e11d383fc7ef03d554779961524afe4169c971534df96960c698043647db407fb8858b002ed6

  • SSDEEP

    24576:2ojjzzhyHX9gTt+pb9sUjFW9nfQ3ASh++q5d6IZLRDiiW7jaVxOldI41a:tbzsOt+R9To9I3Yx5d6IZVeT7mVolmIa

  Score

  10^/10

  eternitycollectionspywarestealer

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2