Extracted

• • Target

    3a5c8bd6b3c42333d6f6e3d466df1ce0.exe

  • Size

    10.1MB

  • MD5

    3a5c8bd6b3c42333d6f6e3d466df1ce0

  • SHA1

    daa0e8307be8af7a82136756c9ba92bba80428f9

  • SHA256

    93624d839aec93e670a5d3484f9b86aeb5a9ead5facae3330b2d046c993c9caf

  • SHA512

    aca4c32ffe384ee98316df1916978a1f72d9c44d5c2c129bfa0fa97c658d4f85e2b6b88989963d4965af06be07083b1d50fcabae002af037826e61faec3f7c0a

  • SSDEEP

    98304:3s+ZZT7ZUAK6dviGesC0YjhvByOyuhbDN/MfTSgTFEzUfobeIIr2j5dwu:3FjJXg9bhvByOyuhbD56EzUflIO2j

  Score

  10^/10

  eternitydiscoverypersistence

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2