Resubmissions
19-08-2024 22:08
240819-12el7asdkm 10Behavioral task
behavioral1
Sample
EMV Reader-Writer v8.6.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
EMV Reader-Writer v8.6.exe
Resource
win10v2004-20240802-en
General
-
Target
EMV Reader-Writer v8.6.exe
-
Size
338KB
-
MD5
6b2aa828fd00b099b6a3f4acb72b96bc
-
SHA1
cfb0ecfdf321d7f3cf068e40bc24b9e29c8ca686
-
SHA256
60f53aece03a8119efd11af5a161d354604fa5f92354b4d39018b2f0b781e65b
-
SHA512
82a5ed821f5e0b02661c88f8d777458703894d8723929dce35c9758e3bcd7d020e8dc27a89e2f7c5eee2f8f92bd69d3a6b3b303d7dc00506c433dfbce0331089
-
SSDEEP
6144:tEtm1/I1LrZ1GXMe9rg5K33kf5n0RbsmxvHWw1i:tEtmexgMe9v0f5n02w2X
Malware Config
Extracted
eternity
http://izrukvro5khcol3z7cvvdq3akeunlod2gshgn7ppo3a4jvse3z5hpiyd.onion
Signatures
-
Eternity family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource EMV Reader-Writer v8.6.exe
Files
-
EMV Reader-Writer v8.6.exe.exe windows:4 windows x86 arch:x86
Password: azbx
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 335KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ