eternity | Latest_Setup4_Here_PassCode_is_10101[.]rar | Triage

Sharing

General

Target

Latest_Setup4_Here_PassCode_is_10101.rar
Size

136KB
MD5

498a4df1a4fc9713129102038e06890a
SHA1

d6bc3863353fc758e1041dfe32647b8d5d7be85e
SHA256

f4d95ce4fd232c7cd942e0169589253ac95421e6ba49e6acb9cd403ca706418f
SHA512

9c61bd40916cf89eea6902a4508dc47717dec5c19a9c3be2a7ce4a5b085034693bce2cc04f858c0e6ef3fdd6edeed2c2715540ce5b9064485a8937f357227e03
SSDEEP

3072:Z8M0eYlKj/2E3Q945zFFZX5mAKmp5ySlmxElJhbObLpy1ySq:Zz0/ItQ92JVKmp5Tl/lJVYLpyESq

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

Eternity family
eternity

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/setup.exe

Files

Latest_Setup4_Here_PassCode_is_10101.rar
.rar

Password: 10101
Read.me.txt
setup.exe
.exe windows x86

Password: 10101

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ