Overview

overview

9

Static

static

7

Eterna.exe

windows7-x64

9

Eterna.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Eterna.exe

  • Size

    4.2MB

  • Sample

    230320-qypymsdg32

  • MD5

    4b16139ce122c3d0dc2c15a04b1d5110

  • SHA1

    9e3321d739ff3813e4289d6dcb177ae3beb93eb5

  • SHA256

    6e5f7ac150e500bc95e33a16b8a6c6a80f750145fd428b16c83ec4e6f21dc957

  • SHA512

    1df0388665e159f2dd26536150b2cab670d9fc7f58cf686dd074dd68875ad9f9793c5139b66bf0ea621b3c41afd2503455ee66c5b71ad9b497f29cde2b8f3b4d

  • SSDEEP

    98304:xIC4bj8JKA9CYVzVJnUxnwsipGxnP3c4+qrUrAqFjrYolcfEBNHA40lZf:WC4bAJPFVJnUxw3UlPcIUrAqFjEEbBNy

Score
9/10
evasionpersistenceransomwarethemidatrojan

Malware Config

Targets

    • Target

      Eterna.exe

    • Size

      4.2MB

    • MD5

      4b16139ce122c3d0dc2c15a04b1d5110

    • SHA1

      9e3321d739ff3813e4289d6dcb177ae3beb93eb5

    • SHA256

      6e5f7ac150e500bc95e33a16b8a6c6a80f750145fd428b16c83ec4e6f21dc957

    • SHA512

      1df0388665e159f2dd26536150b2cab670d9fc7f58cf686dd074dd68875ad9f9793c5139b66bf0ea621b3c41afd2503455ee66c5b71ad9b497f29cde2b8f3b4d

    • SSDEEP

      98304:xIC4bj8JKA9CYVzVJnUxnwsipGxnP3c4+qrUrAqFjrYolcfEBNHA40lZf:WC4bAJPFVJnUxw3UlPcIUrAqFjEEbBNy

    Score
    9/10
    evasionthemidatrojanpersistenceransomware

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Modifies Installed Components in the registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks