General

  • Target

    ggg.exe

  • Size

    904KB

  • Sample

    231018-qq2mgaeh2v

  • MD5

    8b6d6cc25f922c8148d77bc56539b064

  • SHA1

    cb18c3002cf095a704ad32996b789b2ddbf64ca7

  • SHA256

    368a4d20c002e3ac33066d6c20ceb83af485a613ac1507626df0162d8855ad1f

  • SHA512

    c6f50ef0f29cb482d85f8442d0892c7899f4157ddc2970ac2910e5f71bdad882e25c5bc155020036b3309ecf0a75c2a536eb192ce37deff28adcb24bfb97f819

  • SSDEEP

    12288:dTEYAsROAsrt/uxduo1jB0Y96qCNvB2eZJAl3PeWQIVoQSlcltwV0LwqS/SgekZR:dwT7rC6qEfaGzIJr60pvcR

Malware Config

Targets

    • Target

      ggg.exe

    • Size

      904KB

    • MD5

      8b6d6cc25f922c8148d77bc56539b064

    • SHA1

      cb18c3002cf095a704ad32996b789b2ddbf64ca7

    • SHA256

      368a4d20c002e3ac33066d6c20ceb83af485a613ac1507626df0162d8855ad1f

    • SHA512

      c6f50ef0f29cb482d85f8442d0892c7899f4157ddc2970ac2910e5f71bdad882e25c5bc155020036b3309ecf0a75c2a536eb192ce37deff28adcb24bfb97f819

    • SSDEEP

      12288:dTEYAsROAsrt/uxduo1jB0Y96qCNvB2eZJAl3PeWQIVoQSlcltwV0LwqS/SgekZR:dwT7rC6qEfaGzIJr60pvcR

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Eternity stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Modifies Windows Defender Real-time Protection settings

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Windows security modification

MITRE ATT&CK Enterprise v15

Tasks