General

  • Target

    tmp

  • Size

    112KB

  • Sample

    230123-n5yg9adb27

  • MD5

    adc58a2e5e4ee12e37210bb1ce44e92a

  • SHA1

    1f88297c23d085b4c9fa8491c3769b66ac75b28e

  • SHA256

    f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

  • SHA512

    9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

  • SSDEEP

    3072:awEBEGyAUxgnLEKKph6bSBrIbznbKLkcYloZji:acAUxgnLIh6mJIbbGYloZ

Malware Config

Targets

    • Target

      tmp

    • Size

      112KB

    • MD5

      adc58a2e5e4ee12e37210bb1ce44e92a

    • SHA1

      1f88297c23d085b4c9fa8491c3769b66ac75b28e

    • SHA256

      f4d626fdb9bbb2fecaf4eba2f03db99875c1410beffa641adbf741132e1a6c2f

    • SHA512

      9cac4f661e541f2033ac7a5a7ae1d82738e693478dc59c2236c368229782da568d9b574d38193c784404a5a9d862957a203962d8ebfdbb4fa44655a6813518be

    • SSDEEP

      3072:awEBEGyAUxgnLEKKph6bSBrIbznbKLkcYloZji:acAUxgnLIh6mJIbbGYloZ

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v6

Tasks