eternity | GABB[.]0[.]6[.]20[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

GABB.0.6.20.zip
Size

2.5MB
MD5

9677bed9b47650af4ce668771025aa46
SHA1

e3976927340836348a63d53f8a4197587bfa9482
SHA256

c6d2e587b941ba4be62d9ca99e70db987a3a17a3128508cf69c86ac15e2d589b
SHA512

c8998b2c0609ec3b6ba7cf8c8504fbe4c535162426d11b08f3a088dee908bb6e6b59f86af447009690cd21657a7abdf0202ae86a977e2632a13918f59c16f26a
SSDEEP

49152:VIH+LrDl8CIZKWC8ulQiriV/jO2zdNzJYR31RF3p6CzRdWbgjcDPIjib:VnrDtWWfcOaNzqhtzRSgjcDPIjY

Score

10^/10

stealer eternity

Malware Config

Signatures

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
static1/unpack001/GABB/GABB.exe	eternity_stealer

Eternity family
eternity

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GABB/GABB.exe
unpack001/GABB/GDLL.dll

Files

GABB.0.6.20.zip
.zip
GABB/GABB.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eter0
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.eter1
Size: 157KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 363KB - Virtual size: 362KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GABB/GDLL.dll
.dll windows:6 windows x86 arch:x86

4d3f081b06b3583c044673d0cf10cbe9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\PC\Desktop\GABB Source\GABB\GABB\Release\GDLL.pdb

Imports

crypt32

CryptStringToBinaryA

kernel32

LocalFree
HeapAlloc
SystemTimeToFileTime
CreateProcessW
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsWow64Process
IsDebuggerPresent
GetExitCodeProcess
CloseHandle
QueryPerformanceFrequency
GetCurrentThread
GetLastError
Sleep
OpenProcess
GetModuleHandleA
DuplicateHandle
ResumeThread
InitializeSListHead
SuspendThread
LocalAlloc
WaitForSingleObject
CreateMutexW
TerminateProcess
GetCurrentProcess
HeapFree
GetProcAddress
GetVolumeInformationW
GetCurrentThreadId
GetCurrentProcessId
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap

user32

GetCursorPos
PostQuitMessage
GetWindowLongW
GetWindowThreadProcessId
DefWindowProcW
PostMessageW
IsWindowVisible
MessageBoxW
keybd_event
CreateWindowExW
ScreenToClient
UnregisterClassW
SetWindowTextW
RegisterClassExW
ShowWindow
SetClassLongW
VkKeyScanExA
GetWindowTextA
GetRawInputData
GetKeyboardLayout
GetForegroundWindow
EnumWindows
RegisterRawInputDevices
SetWindowLongW
SetForegroundWindow

advapi32

SetSecurityDescriptorGroup
AllocateAndInitializeSid
RegEnumKeyExW
RegSetValueExW
IsValidSecurityDescriptor
OpenProcessToken
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegQueryInfoKeyW
AccessCheck
SetSecurityDescriptorOwner
InitializeAcl
RegOpenKeyExW
DuplicateToken
RegDeleteKeyW
RegQueryValueExW
RegEnumValueW
OpenThreadToken
AddAccessAllowedAce
GetLengthSid

shell32

SHGetFolderPathW
ShellExecuteW

msvcp140

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Throw_C_error@std@@YAXH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Xlength_error@std@@YAXPBD@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Xtime_get_ticks
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z

vcruntime140

__std_exception_copy
memmove
memcpy
__std_type_info_destroy_list
memset
_CxxThrowException
__current_exception_context
__current_exception
_except_handler4_common
memchr
__CxxFrameHandler3
__std_exception_destroy
__std_terminate

api-ms-win-crt-runtime-l1-1-0

exit
_initterm_e
_initterm
_cexit
_crt_atexit
terminate
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
fgetc
fputc
setvbuf
fgetpos
fwrite
fflush
fclose

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
free
malloc

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-convert-l1-1-0

atoi

Exports

Exports

?Close@GABBE@@YAXXZ
?CloseWindow@GABBE@@YAXH@Z
?DeleteAccount@GABBE@@YAXH@Z
?EditAccount@GABBE@@YAXHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?EventLoop@GABBE@@YA?AV?$vector@U?$pair@HV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@V?$allocator@U?$pair@HV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@@2@@std@@XZ
?GetAccounts@GABBE@@YA?AV?$vector@UACCUSER@@V?$allocator@UACCUSER@@@std@@@std@@XZ
?GetCurrentAccount@GABBE@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetPath@GABBE@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@@Z
?GetRandomMAC@GABBE@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetTheme@GABBE@@YAHXZ
?GetWindows@GABBE@@YA?AV?$vector@U?$pair@HV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@std@@V?$allocator@U?$pair@HV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@std@@@2@@std@@XZ
?Init@GABBE@@YAXXZ
?KeepSessionUp@GABBE@@YAXXZ
?LogIn@GABBE@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?LogOut@GABBE@@YAXXZ
?MBState@GABBE@@YA_NH@Z
?MBState@GABBE@@YA_NH_N@Z
?MBStateAll@GABBE@@YA_N_N@Z
?MacroAddInstance@GABBE@@YAXXZ
?MacroGetInstance@GABBE@@YA?AU?$pair@V?$vector@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@V?$vector@HV?$allocator@H@std@@@2@@std@@H@Z
?MacroGetList@GABBE@@YA?AV?$vector@U?$pair@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@V?$allocator@U?$pair@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@2@@std@@XZ
?MacroRemoveInstance@GABBE@@YAXH@Z
?NewAccount@GABBE@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?NewWindow@GABBE@@YAXXZ
?OpenInBrowser@GABBE@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetAccount@GABBE@@YAXH@Z
?SetAccountRandom@GABBE@@YAXXZ
?SetTheme@GABBE@@YAXH@Z
?SpammerAddInstance@GABBE@@YAXXZ
?SpammerAddText@GABBE@@YAXHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SpammerDelText@GABBE@@YAXHH@Z
?SpammerGet@GABBE@@YA?AU?$pair@V?$vector@U?$pair@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@V?$allocator@U?$pair@HV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@2@@std@@V?$vector@HV?$allocator@H@std@@@2@@std@@H@Z
?SpammerGetDesc@GABBE@@YA?AV?$vector@HV?$allocator@H@std@@@std@@H@Z
?SpammerGetInstances@GABBE@@YA?AV?$vector@U?$pair@HU?$pair@_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@V?$allocator@U?$pair@HU?$pair@_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@@2@@std@@XZ
?SpammerNoshift@GABBE@@YAX_N@Z
?SpammerRandom@GABBE@@YAXH_N@Z
?SpammerRemoveInstance@GABBE@@YAXH@Z
?SpammerSetIds@GABBE@@YAXHV?$vector@HV?$allocator@H@std@@@std@@@Z
?SpammerSetInter@GABBE@@YAXHHH@Z
?SpammerState@GABBE@@YAXH_N@Z
?SpammerStateAll@GABBE@@YAX_N@Z
?UpdateSettings@GABBE@@YAXXZ
?UpdateTimer@GABBE@@YAXHH@Z
?bringToFront@GABBE@@YAXH@Z
?changeVisibility@GABBE@@YAXH@Z
?decodeFile@GABBE@@YA?AV?$vector@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@@std@@V?$allocator@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@2@@std@@@2@@std@@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@3@@Z
?decodeSetFilter@GABBE@@YAX_N@Z

Sections

.text
Size: 119KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.eter0 Size: 2.2MB - Virtual size: 2.2MB

.eter1 Size: 157KB - Virtual size: 156KB

.rsrc Size: 363KB - Virtual size: 362KB

.reloc Size: 512B - Virtual size: 12B

4d3f081b06b3583c044673d0cf10cbe9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

crypt32

kernel32

user32

advapi32

shell32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

Exports

Exports

Sections

.text Size: 119KB - Virtual size: 119KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.eter0
Size: 2.2MB - Virtual size: 2.2MB

.eter1
Size: 157KB - Virtual size: 156KB

.rsrc
Size: 363KB - Virtual size: 362KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 119KB - Virtual size: 119KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 6KB