Resubmissions

05/03/2023, 16:18

230305-tr3spsgg64 10

General

  • Target

    Stealer-vm.zip

  • Size

    153KB

  • Sample

    230305-tr3spsgg64

  • MD5

    0db55c1838de91e5c2a8f472ac38989f

  • SHA1

    353b1f055133789b136b1733c5016909c249775a

  • SHA256

    0dc4c3ce5980c3d70752a9c0e5e7d3fae58c0ef48ae9e6cbe0927c52616701a8

  • SHA512

    c9ac942f73204996fe2b6fac0575914de63cc25940b64b03387d2b2e4576af926a13834ee831743f330fe21d136e27d80e6b072f0d431e76205c5f1f9544633a

  • SSDEEP

    3072:CTd11ifJnWYxIPpEZSC+WCVk7x/wb923hLeykklrGv7qbCVL:6d11SJnBGpEZJ48lwbg0zNt

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Targets

    • Target

      Stealer.exe

    • Size

      334KB

    • MD5

      f505c99287810f7b1a797515169f96db

    • SHA1

      9866580b607e9419fb83f41194b2da0902e5ee21

    • SHA256

      14a058b86f673e476ef336155cdb437d9891a9f146fe11c4837c092dfcd9d5c0

    • SHA512

      37f1608da2348c6584a5e1ff5453be6f12d84d46462f0a9363f40a265c4d8fc9fff8553e01af259167cc95551542c9911befb7fa13acc8e4f22ed72b1d2c3a6a

    • SSDEEP

      6144:G8em0Zl5+OUMUEzDodTVQzZWWjwXO83nI02x2bVm/FQNOp:G8em0JLixioWjN8X4J

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v6

Tasks