General

  • Target

    tz_project.exe

  • Size

    904KB

  • Sample

    240715-ahxesayfpm

  • MD5

    6b2f18cbf35253af423a68a266a8de77

  • SHA1

    2e8cba91ca4d1cd619afa10c95b0abce8c4ffd61

  • SHA256

    378e73163cdc250496de7411f5a9bab810786e49b39a51e80c39f17139c5d7b2

  • SHA512

    3b98f0d4aba56abb844ac83e61a417712487b527243cd8a83fa0be95eae70f8fa054e0dda0e3ecfa99fed9b36ad1572c6a9f5cb122a69fe86987198ea46435ff

  • SSDEEP

    12288:UTEYAsROAsrt/uxduo1jB0Y96q3hHENbBqAmViSSQJLFSTvyaWumDMxx4EN1SLvu:UwT7rC6qRHKbBhsD/yvSgN1CvXDa

Malware Config

Targets

    • Target

      tz_project.exe

    • Size

      904KB

    • MD5

      6b2f18cbf35253af423a68a266a8de77

    • SHA1

      2e8cba91ca4d1cd619afa10c95b0abce8c4ffd61

    • SHA256

      378e73163cdc250496de7411f5a9bab810786e49b39a51e80c39f17139c5d7b2

    • SHA512

      3b98f0d4aba56abb844ac83e61a417712487b527243cd8a83fa0be95eae70f8fa054e0dda0e3ecfa99fed9b36ad1572c6a9f5cb122a69fe86987198ea46435ff

    • SSDEEP

      12288:UTEYAsROAsrt/uxduo1jB0Y96q3hHENbBqAmViSSQJLFSTvyaWumDMxx4EN1SLvu:UwT7rC6qRHKbBhsD/yvSgN1CvXDa

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Eternity stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Modifies Windows Defender Real-time Protection settings

    • Disables Task Manager via registry modification

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks