General

  • Target

    bc635c0f865ce0d70a81c35bb9c05a93.exe

  • Size

    2.1MB

  • Sample

    230408-rz96msdf86

  • MD5

    bc635c0f865ce0d70a81c35bb9c05a93

  • SHA1

    eb5a3366e60b642b4abd50dffe3be2afb44d7b39

  • SHA256

    cee47a59d39ea4da5facfeb62f67b0f1dce28b39863e66c22efee52eb6498647

  • SHA512

    e4326fcea0158e1b1edf94c0a14464d26e4794976ffd4201f1551a0b40fefb5646607ec9245f9051723bf3319f74a3353a352be851c8cebfdbf808ddc3e0f688

  • SSDEEP

    49152:ArScto7a+dk0Ek6ae78ywIDmVh5pdiFrbGo2XA9uq7FW:+BVw9KbGB+X7w

Score
10/10

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes
  • payload_urls

    http://167.88.170.23/swo/sw.exe

    http://167.88.170.23/swo/swo.exe

Targets

    • Target

      bc635c0f865ce0d70a81c35bb9c05a93.exe

    • Size

      2.1MB

    • MD5

      bc635c0f865ce0d70a81c35bb9c05a93

    • SHA1

      eb5a3366e60b642b4abd50dffe3be2afb44d7b39

    • SHA256

      cee47a59d39ea4da5facfeb62f67b0f1dce28b39863e66c22efee52eb6498647

    • SHA512

      e4326fcea0158e1b1edf94c0a14464d26e4794976ffd4201f1551a0b40fefb5646607ec9245f9051723bf3319f74a3353a352be851c8cebfdbf808ddc3e0f688

    • SSDEEP

      49152:ArScto7a+dk0Ek6ae78ywIDmVh5pdiFrbGo2XA9uq7FW:+BVw9KbGB+X7w

    Score
    10/10
    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks