eternity

General

Target

27d3a6830b69e204d697b55973f8aeee.exe
Size

170KB
Sample

230309-zdkb4abh21
MD5

27d3a6830b69e204d697b55973f8aeee
SHA1

290a3ac46cad1085619f251ed2bb8617d4925d71
SHA256

25b4a9aa2ac6722d1369c5a5d78aeeadb2cfffb4dc85be0878e6a7c84cee57c4
SHA512

9563bf93ed16298ee0a8efca9cb07b811deefb7ebdb48f87a926b5e4884405ac3bd1e0990000020ffdf8c228d57a61ea89292037cc5a68b8d0bf72501175581c
SSDEEP

3072:H5Amlz0sC++in5op8sNjlL7473FwtYA2JoMX4PuYNWwI1GJ171dwY2TIof:Z3m5pA7V/Lsw1A1pdPFo

Score

10^/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
http://95.214.27.203:8080/upload/wrapper.exe
http://95.214.27.203:8080/upload/oigmre.exe,http://95.214.27.203:8080/upload/handler.exe

Extracted

Family

redline

Botnet

new1

C2

85.31.46.182:12767

Targets

- Target
  
  27d3a6830b69e204d697b55973f8aeee.exe
- Size
  
  170KB
- MD5
  
  27d3a6830b69e204d697b55973f8aeee
- SHA1
  
  290a3ac46cad1085619f251ed2bb8617d4925d71
- SHA256
  
  25b4a9aa2ac6722d1369c5a5d78aeeadb2cfffb4dc85be0878e6a7c84cee57c4
- SHA512
  
  9563bf93ed16298ee0a8efca9cb07b811deefb7ebdb48f87a926b5e4884405ac3bd1e0990000020ffdf8c228d57a61ea89292037cc5a68b8d0bf72501175581c
- SSDEEP
  
  3072:H5Amlz0sC++in5op8sNjlL7473FwtYA2JoMX4PuYNWwI1GJ171dwY2TIof:Z3m5pA7V/Lsw1A1pdPFo
Score

10^/10

eternity discovery redline sectoprat new1 infostealer persistence rat spyware stealer trojan
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2