eternity

General

Target

AJProxy_3.0.zip
Size

5.9MB
Sample

241230-nakmxaxpez
MD5

15d0e9c9f528aaf2198153fc0b70265e
SHA1

3fea5aabe3974d5fb515c6247abc93e9c481c87e
SHA256

df1f1e02e8b95f351ea612561399e0a05252009bd0c8bcabade1af042e4cc754
SHA512

fdbf5f22b3ed12bbf949bc20c7647ab91fe6491ff28a9f12916a9af350dfc6971599fd3a588b728e648504c83d315e2cc41330cc84a70a55fe4bb05ce34044c5
SSDEEP

98304:Mc5Vo7LeRRDoiif0xJmth8TcZ9fCi4UmoJcs9juLgt59302frWH4:1o2wKmthVZtCiVm1XMptyH4

Score

10^/10

Malware Config

Targets

- Target
  
  AJProxy_3.0/AJProxy3.0.exe
- Size
  
  887KB
- MD5
  
  948298bd9dec41df13cbc007cacc3e70
- SHA1
  
  822ba513d2263161590f9db62fa83d417b5dbb54
- SHA256
  
  1324fff98ceaf46786fa86c449c0829804b668718f2a73f1daa6343d7eecd426
- SHA512
  
  76fd8d2190d7e9cc2582123c579af214bba467001b1faf2c4ed96d60f6b7fb695301ebfa141052a4c4847a38a54c64bd117f5b052ced1f4cfc5de4667630b906
- SSDEEP
  
  24576:DwT7rC6qJfn+1RChT+BHubaRo6Mh/2aUUdt4:KrC6q5Go6Ma0W
Score

10^/10

eternity stealer discovery
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Eternity family
  eternity
- Drops startup file
- Executes dropped EXE
behavioral1 behavioral2
- Target
  
  AJProxy_3.0/Growpai.dll
- Size
  
  5.1MB
- MD5
  
  820f600e343d5759d8ead9549655ba16
- SHA1
  
  20fc71302fb0b24c90f97d33926d3a3dc4193ec2
- SHA256
  
  27edfdebaa896c849b0fe1c354d3bb82bb70807cb870bbaafa87146026502c4f
- SHA512
  
  a3019b7bf24cb7f971a5e05479e382139000053ee8c9b011f58b2b01e6235a9b4365b571105c23a2ccfccade95ae1e0339dccfacb51eeb5cc7e5d071369119cf
- SSDEEP
  
  98304:bc5Vo7LeRRDoiif0xJmth8TcZ9fCi4UmoJcs9juLgt59302x:Yo2wKmthVZtCiVm1XMptx
Score

9^/10

evasion themida trojan
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4