Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/01/2025, 14:48
General
-
Target
Eternity.exe
-
Size
40.8MB
-
MD5
40f0212fa97e2fe44ee0fbffae0c96b5
-
SHA1
e11664504e7b3ab905de8069e6fb5b1159aec002
-
SHA256
32d38e1eae86466254658d5a91a8bca983706b3aec35148012cb0a50f550a74f
-
SHA512
2eeebc345f202033762cfa1e5ae4a2b2f477dad7e7019e5aff7b3aff98d0a9ee7c2223a94dfb6cc1a6fd66eb0290adee3baa1fda8d99658253c005ca11f425f5
-
SSDEEP
786432:gHvsyBy7Mu30RSVRAaAeQc98NmhJQ8mZoJRWUmx2qmE:gUyCMrUVKa/bhJQ8mZorV+
Malware Config
Signatures
-
Growtopia
Growtopa is an opensource modular stealer written in C#.
-
Growtopia family
-
Loads dropped DLL 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Eternity.exe"C:\Users\Admin\AppData\Local\Temp\Eternity.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e13ef136485a33c8a5b719d75b0312df
SHA1fb692915b0a73e796c5904e05d37f963baef88dd
SHA2569d2d83667ab5c391fbb60a1249078d0e2b031573a72dc07b67b610178ee94e78
SHA512b3d58a11fc17925316f437e67d4b394bb9b5749e92064fe87eda3e12962f3970416e180cd40c61419651ec611eae0ee9f91a795199689cdd4743678bb6d3dca2
-
Filesize
104KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
19.6MB
-
Filesize
856KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
40.6MB
-
Filesize
712KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB