Resubmissions

23/02/2025, 15:26

250223-st7n1a1nhs 3

23/02/2025, 15:19

250223-sqj4ja1ndv 10

General

  • Target

    tinytask.ini

  • Size

    145B

  • Sample

    250223-sqj4ja1ndv

  • MD5

    ceeacd35fe5d94dbf023d3ceddbfdc9f

  • SHA1

    d7417facd69ad39d6192e75b0eb82e0b6b53a447

  • SHA256

    24f7bda2e6d6eaa5608e027d1fe70958e956e9dc9a52ae1faf18d06982036ee7

  • SHA512

    5724bc671dafbf78b643177bf8f9eb2803537c104d7cbd93878561d30d707c1346f2426465ff2592f81d1e5c701cc534b5ddd657040d285191cd6bb557b4e8dc

Malware Config

Targets

    • Target

      tinytask.ini

    • Size

      145B

    • MD5

      ceeacd35fe5d94dbf023d3ceddbfdc9f

    • SHA1

      d7417facd69ad39d6192e75b0eb82e0b6b53a447

    • SHA256

      24f7bda2e6d6eaa5608e027d1fe70958e956e9dc9a52ae1faf18d06982036ee7

    • SHA512

      5724bc671dafbf78b643177bf8f9eb2803537c104d7cbd93878561d30d707c1346f2426465ff2592f81d1e5c701cc534b5ddd657040d285191cd6bb557b4e8dc

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Detects Eternity stealer

    • Eternity

      Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    • Eternity family

    • Modifies Windows Defender DisableAntiSpyware settings

    • Modifies Windows Defender Real-time Protection settings

    • Disables Task Manager via registry modification

    • Drops startup file

    • Executes dropped EXE

    • Windows security modification

MITRE ATT&CK Enterprise v15

Tasks