Extracted

• • Target

    c8160bcafcd6bf27d9b37ffd1985e029.exe

  • Size

    1018KB

  • MD5

    c8160bcafcd6bf27d9b37ffd1985e029

  • SHA1

    fa8da691a6fddb294174eca4ee3cb222bbf3ab20

  • SHA256

    f3253a3732bc4b99f4cca79e439d9f2fb25d6a4e1a75e47228b6aa8a5175e4b4

  • SHA512

    20f80c5f6af3e8d48c89517f411e6e6820190f5fb170314e727e8e4cb42bae303ca47b1213502f8f44766ff9a4d1f7739d4f64de6914ed519376a9c421bcf041

  • SSDEEP

    12288:lToPWBv/cpGrU3y4CDFOkZdhvRH9EfIpops7SQlMDbkHB6B1rAiQ13+jxLEj2NJJ:lTbBv5rUqDFzhvxpFKUEBCjDWhvP

  Score

  10^/10

  eternityclipperpersistence

  • Detects Eternity clipper

    clipper

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2