eternity

General

Target

3d43c7a4be9da757591f4052c133b58f_JaffaCakes118
Size

6.6MB
Sample

241013-ctsxvaycrn
MD5

3d43c7a4be9da757591f4052c133b58f
SHA1

52e4b0b06bab446a5701211a4322e5d3fa70ebe6
SHA256

d572a3e702f57df2dd68da71520522dea73e0b71e4d7087361fafb8d3afa75a5
SHA512

73635ed70b2cdd302448c2229a8a59584e786712dd877958111f06060c7724c1f0f7ea64deeb1a0221d76505f19ac734338f0a809c8d41313bd7b968a5035ce1
SSDEEP

196608:m405QYtsTEB08T8HehLvMKGQe15RaCpLl39hMsYr:mVdfB08TOehAgevAChB9Od

Score

10^/10

Malware Config

Targets

- Target
  
  3d43c7a4be9da757591f4052c133b58f_JaffaCakes118
- Size
  
  6.6MB
- MD5
  
  3d43c7a4be9da757591f4052c133b58f
- SHA1
  
  52e4b0b06bab446a5701211a4322e5d3fa70ebe6
- SHA256
  
  d572a3e702f57df2dd68da71520522dea73e0b71e4d7087361fafb8d3afa75a5
- SHA512
  
  73635ed70b2cdd302448c2229a8a59584e786712dd877958111f06060c7724c1f0f7ea64deeb1a0221d76505f19ac734338f0a809c8d41313bd7b968a5035ce1
- SSDEEP
  
  196608:m405QYtsTEB08T8HehLvMKGQe15RaCpLl39hMsYr:mVdfB08TOehAgevAChB9Od
Score

10^/10

eternity discovery evasion spyware stealer trojan upx
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Disables Task Manager via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2