Overview

overview

10

Static

static

3

348cc43725...52.exe

windows7-x64

10

348cc43725...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    348cc43725f4e3547e7ac1c95a3ef094b2a769393829f4dadbe4882dd41e6452

  • Size

    3.0MB

  • Sample

    230821-bn3z7aab34

  • MD5

    4dcc578f59fbcd01a367501fa1d4f42f

  • SHA1

    d4586895aef6e108d6d7fd248f4d3daef151138c

  • SHA256

    348cc43725f4e3547e7ac1c95a3ef094b2a769393829f4dadbe4882dd41e6452

  • SHA512

    996d0233cbaac937b24bb8c50dc99876656c9912401ece028e6d16f62d0b0b888c1808aad9ddf9fbb5aa86288c921f70dec402c960e4854b1dcbfb2d1b737ce0

  • SSDEEP

    6144:29xMcYa+tnoCNsBEODVcTC6GJNS2zQiAkrOb8pgoc6vyNIfhoqBnbFgcWsM:2ccZ+JSPhomgcWD

Score
10/10
eternityclipper

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Wallets

bc1qe7z6nlxlx27fgr6ytsat6hz5t3sl0nsdtmhamn

qr47e98jys35s5npdwt5mfeq0jlvvff5rc2lshtxp2

0x2433680E4f5faA462041cC17237A898c4eE178c5

0xdbCedAEF11817bad20b278eB28d3AfEDa4C63C54

0xdbCedAEF11817bad20b278eB28d3AfEDa4C63C54

0xdbCedAEF11817bad20b278eB28d3AfEDa4C63C54

DSGVHd7VFkL6WeuEgSwst8hQfJ1jCAeiSW

TWuMkEbgzUdTLSW1dHgKT5MhFk4Qc9yMKW

ltc1qkee6dw657yp3l3xls8f5q9tva0we3m0lahf4ht

rhfQuFy8Gse1FinEHxsgCxwonKuUnMr73U

t1XHKggRimUkPvjBvW2Aum4UudRhujhMQgn

XfZro7RFb7SdHPhoJh1aXhRouaGdg3wtPr

GALTQXW2QSOIENOE7SVJAQYTKSN7DJ4JFUITAIK3AD3QSW7EQKOSRZDT

bnb16fchdnr90kqp8g3ujperk7r5kkrg3xuystg82z

6A7E4DchBSBt9bQgmKDZ3AW7g5Pshsh6qu4GGQgkJYDz

Targets

    • Target

      348cc43725f4e3547e7ac1c95a3ef094b2a769393829f4dadbe4882dd41e6452

    • Size

      3.0MB

    • MD5

      4dcc578f59fbcd01a367501fa1d4f42f

    • SHA1

      d4586895aef6e108d6d7fd248f4d3daef151138c

    • SHA256

      348cc43725f4e3547e7ac1c95a3ef094b2a769393829f4dadbe4882dd41e6452

    • SHA512

      996d0233cbaac937b24bb8c50dc99876656c9912401ece028e6d16f62d0b0b888c1808aad9ddf9fbb5aa86288c921f70dec402c960e4854b1dcbfb2d1b737ce0

    • SSDEEP

      6144:29xMcYa+tnoCNsBEODVcTC6GJNS2zQiAkrOb8pgoc6vyNIfhoqBnbFgcWsM:2ccZ+JSPhomgcWD

    Score
    10/10
    eternityclipper

    • Detects Eternity clipper

      clipper

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

      eternity

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks