eternity

General

Target

yes.png
Size

158KB
Sample

250105-pn3w3stqaw
MD5

2364ecb2d3966d365806878891a7cc00
SHA1

35c38f9e237a3b942c16f36c90292ade83ab496f
SHA256

aae7699b056e19bc9fd9ba3c5aa7571c2505cdd50108ae71b9d31fc690109c82
SHA512

2b8d46a63b1843cb44516a4632c1f689b25a1e55610762534e875753f98b367c814dc5981d88edb562c21f18d9f5dfa9432f8997ac380af02b79f0ea51357859
SSDEEP

3072:YOSE3N6QqCZNm3HXTu18hI/+g8MWqkPctocnlN7OEMm066SfTwFd6VFc2UTQ:lSENqwNOw8hVF9c2clN6EbUAg3rTQ

Score

10^/10

Malware Config

Targets

- Target
  
  yes.png
- Size
  
  158KB
- MD5
  
  2364ecb2d3966d365806878891a7cc00
- SHA1
  
  35c38f9e237a3b942c16f36c90292ade83ab496f
- SHA256
  
  aae7699b056e19bc9fd9ba3c5aa7571c2505cdd50108ae71b9d31fc690109c82
- SHA512
  
  2b8d46a63b1843cb44516a4632c1f689b25a1e55610762534e875753f98b367c814dc5981d88edb562c21f18d9f5dfa9432f8997ac380af02b79f0ea51357859
- SSDEEP
  
  3072:YOSE3N6QqCZNm3HXTu18hI/+g8MWqkPctocnlN7OEMm066SfTwFd6VFc2UTQ:lSENqwNOw8hVF9c2clN6EbUAg3rTQ
Score

10^/10

eternity discovery evasion execution persistence phishing privilege_escalation stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer
  stealer
- Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Eternity family
  eternity
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  evasion
- Downloads MZ/PE file
- Drops file in Drivers directory
- A potential corporate email address has been identified in the URL: Caveatitalwght@0400
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
behavioral1