eternity

General

Target

61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60
Size

1.7MB
Sample

231129-q96ersgf73
MD5

ed023543b40e9ebaf6cb40da28074173
SHA1

986bd1989695ea88b503f7e40958a17b5c635b0e
SHA256

61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60
SHA512

75629fcd087df7197ff678a1d8b165774486e84129df26ac2ad40f1654804cb043f31816650c74d62252286e9a4644edf54216322c99e68161900957ca180b59
SSDEEP

49152:M/pGRzjjMoZ0NmuCBdOMYVcbCD23Eflux69AJe:qpIEmZUT2Wjm2

Score

10^/10

Malware Config

Extracted

Family

risepro

C2

194.49.94.152

Extracted

Family

redline

Botnet

horda

C2

194.49.94.152:19053

Extracted

Family

smokeloader

Version

2022

C2

http://194.49.94.210/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

@ytlogsbot

C2

194.169.175.235:42691

Extracted

Family

redline

Botnet

LiveTraffic

C2

195.10.205.16:2245

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Targets

- Target
  
  61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60
- Size
  
  1.7MB
- MD5
  
  ed023543b40e9ebaf6cb40da28074173
- SHA1
  
  986bd1989695ea88b503f7e40958a17b5c635b0e
- SHA256
  
  61afab1517020d59a2db1eaf174cc1acf1a59af7a8515a1b5ea3a0d10a8eac60
- SHA512
  
  75629fcd087df7197ff678a1d8b165774486e84129df26ac2ad40f1654804cb043f31816650c74d62252286e9a4644edf54216322c99e68161900957ca180b59
- SSDEEP
  
  49152:M/pGRzjjMoZ0NmuCBdOMYVcbCD23Eflux69AJe:qpIEmZUT2Wjm2
Score

10^/10

eternity privateloader redline risepro smokeloader zgrat @ytlogsbot horda livetraffic backdoor infostealer loader persistence rat stealer trojan
- Detect ZGRat V1
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- RisePro
  RisePro stealer is an infostealer distributed by PrivateLoader.
  stealer risepro
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1