eternity | ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4 | Triage

Sharing

General

Target

BirlikProxy.exe
Size

1.5MB
Sample

241006-zrqq2azcmh
MD5

a4fa9334e4b91569e951e86a4c4dfe25
SHA1

4a64997f0688fb4040c624643ce03753a24dc6f6
SHA256

ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4
SHA512

4ec34c9d6e0fd28dac4ef15a2b44a6788db19b0d61a9214f887f4b5f2bade8827c28ad70ba980a27d9bb2c04707e09aaa29722eedd6561ac5c7cecd9e4fff6e0
SSDEEP

24576:swT7rC6qr+eycj8I9WZe/FYQgGhcxKbC+eycj8I9:drC6qr+e3Ke/uVYC+e3

Score

10^/10

eternity discovery evasion spyware stealer trojan

Malware Config

Targets

- Target
  
  BirlikProxy.exe
- Size
  
  1.5MB
- MD5
  
  a4fa9334e4b91569e951e86a4c4dfe25
- SHA1
  
  4a64997f0688fb4040c624643ce03753a24dc6f6
- SHA256
  
  ae2f20d5d4201cd5f7efce0835e93ab5c9ac11f4a819d73a1e3721d7b37286a4
- SHA512
  
  4ec34c9d6e0fd28dac4ef15a2b44a6788db19b0d61a9214f887f4b5f2bade8827c28ad70ba980a27d9bb2c04707e09aaa29722eedd6561ac5c7cecd9e4fff6e0
- SSDEEP
  
  24576:swT7rC6qr+eycj8I9WZe/FYQgGhcxKbC+eycj8I9:drC6qr+e3Ke/uVYC+e3
Score

10^/10

eternity evasion spyware stealer trojan discovery
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Disables Task Manager via registry modification
  evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

stealereternity

behavioral1

eternityevasionspywarestealertrojan

behavioral2

eternitydiscoveryevasionspywarestealertrojan