Eclipse_Installer.zip
- SHA256 0ecc216ba702167f6d2134a5282fb17d911b991555812e60124e5b2605b1a892
Overview
overview
10Static
static
10Eclipse Core.dll
windows7-x64
1Eclipse Core.dll
windows10-2004-x64
1Eclipsein.exe
windows7-x64
1Eclipsein.exe
windows10-2004-x64
1Guna.UI.dll
windows7-x64
1Guna.UI.dll
windows10-2004-x64
1Guna.UI2.dll
windows7-x64
1Guna.UI2.dll
windows10-2004-x64
1Utilla.dll
windows7-x64
1Utilla.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Eclipse Core.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Eclipse Core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Eclipsein.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Eclipsein.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Guna.UI.dll
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Guna.UI.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Guna.UI2.dll
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Guna.UI2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Utilla.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Utilla.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target Eclipse_Installer.zip
- Size 2.4MB
- Sample240607-11va9aec89
- SHA256 0ecc216ba702167f6d2134a5282fb17d911b991555812e60124e5b2605b1a892
- MD5 4c0205d6f47b8fd86db03a820411a72b
- SHA1 8033e6a6d2dadaf388f21876d70545af17b46173
- SHA512 6c1a98fa5e7b51b488ac83d34168f41c03a8fba61fe8ef42a0a7a1ca88c3c88c06166ce95c7f006013c4215dabb3967336455c565a0d9aa3a109b201d93eeb69
- SSDEEP 49152:8ay0KQ298ESGrBjBBSmYuch433MwYXEjPPZ9elC3ODYFH3/rvOprj3xGxL:C0KQ2iEf9LnjF332UjHi83tPrmdx2L
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Eclipse Core.dll unpack001/Eclipsein.exe unpack001/Utilla.dll
File Explorer
-
Eclipse_Installer.zip.zip 2.4MB
-
BepInEx.cfg5KB
-
Eclipse Core.dll.dll 2.9MB
-
Eclipsein.exe.exe 14KB
-
Guna.UI.dll.dll 1.1MB
-
Guna.UI2.dll.dll 2.1MB
-
Utilla.dll.dll 29KB
BepInEx.cfg
- SHA256 932f8dd7e44d2e9c4ba75749baf73265022355ee70890f71d3ea4f654b35ccc3
- MD5 6a31c1401096b638309f84c1d7ac8f17
- SHA1 bd37ee2fba5b6545d6305a0a9f603f6e472c4f9e
- SHA512 8497edd20552a7ee71b6248499c43093ec7e7ea80a00154f92f30d63f032967066408f2dd4009b70c7d5ced301cec9293b9aa954583a740d87025abaabe2fdff
- SSDEEP 96:5XjESNjBkjnxTLmtnUdxU36pU366GCnOU:Ti4UbU36pU366z
- MD5 SHA1 SHA512 SSDEEP
Eclipse Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b356a1d993bbf6ae4f3a4a3c074c33e07d21724d4eca2e16572196c714c3c49d
- MD5 956f57efeb020cbbd703788907932494
- SHA1 7dfedbb3606dbf715576abc5a0818635a53a6f93
- SHA512 c9adf90f214889fa3f8d23e1e3152e76609eeba81a5a3de986e4efbb9ac34eb8e7073bb080bcfc4be45707f6cc2aa41cd5f7c805b67060ddb83b4797912aa7e6
- SSDEEP 12288:66CM0cyj7dZDl5Zb++cS0X8+kPorKpEQ/CzyS0phGsuCR2WoN2NyDlUwHgML25zO:yndZDlvb++cmFphGIR2W24wxLmCIFJC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3092622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Eclipsein.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 84ffc72bc183f717343852dd9ba593a755a3bc9e7ec8619bb452d47e48ea9b42
- MD5 9616f110d3b5b50cadaf5d91fb4f06ce
- SHA1 ccf17b30701b74fa84decc7a3ec1351e5d0b4a0e
- SHA512 f9faecdd3764b0e6f2b6fe2e627e3269658c49790488a53ad52c9b169a9b0d06d90ffcfad255f60d761b7d849bba5a793c2d9c271c7ff87d9d9ea8f5b1ea2712
- SSDEEP 384:JL+8f5O7mYkbJv8kkYd+r/J9LWCWppuokwtwAuXfx:Jph6mYA0r/JRW8p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\cjg71\source\repos\Eclipsein\Eclipsein\obj\Debug\Eclipsein.pdb
mscoree
_CorExeMain
Name
.text
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Guna.UI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d
- MD5 8673eae95d67e5eb19f0eca3111408e8
- SHA1 ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb
- SHA512 65c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239
- SSDEEP 24576:hUsmpWNSUFmCqJPNsTuJDYYviEcHy1t6Y:hSUQWSF8q
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
3f:f5:b3:24:9f:84:88:19:f3:b5:45:4a:64:72:1b:3d:3f:77:2d:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Mar 23, 2020
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Minor OS version
0
Major OS version
4
Entry point
1136746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Guna.UI\Guna.UI\bin\Release\build\.net 4.0\Guna.UI.pdb
mscoree
_CorDllMain
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
dotnet
Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cad8bb34cf070c10e995ebdb60d9d1b4e206bc763183a8cdfb29e17ffa30dd10
- MD5 fc5aba3c395c5f9098cb8e2f78e17022
- SHA1 217061a89757a1d6eb976ad48fb9c93a7a58edcb
- SHA512 148b275edaccd403ee7dcb70e959b29a22ed1c5f61b674afb94af6e9e6b010bb0a7dd9e964d2811dff9c2642a49bb278cc1a838a4f384f5648470187ee83936d
- SSDEEP 49152:YTTFBySg6etzcwp8fB0hXGErGn9lut4XrgF0:irG8farRo
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
fc:f1:4f:80:29:85:d5:17:61:00:50:90:0b:29:ff:b3:2a:f2:5b:54
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2225806
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Utilla.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a9ee48d6def93f75965ff52b13b9fe93a706bea399ab0d5fc8006c7d1987f102
- MD5 c8c0138f48c7dec6a9e9ed4448b80e1b
- SHA1 dba5dbc8bcecbb03b615fa266335189296c05720
- SHA512 2d3b94f0444d6ac463062483e34aaf8ab3e53e86bc034b0845243f2da39176a096e0982aca704e55ef3ab25996c79dae2e61555597f7745168a1732cf2eb7e7b
- SSDEEP 768:yZjwXURi7uRCV3HBdrXm8VOqBDOg5MXY+:esXAiqCVHrXFVJkg5MXz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35362
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\Utilla\Utilla\Utilla\obj\Release\netstandard2.1\Utilla.pdb
mscoree
_CorDllMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
860B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ