General
- Target 2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luca-stealer_lynx_njrat_redline-stealer
- Size 821KB
- Sample260210-pl8dsads7d
- SHA256 99dacfaffe443309956d4ffa10b58e5c87de6c73339473712d9ade2cda57c923
- MD5 0040df58dec2a37687a885bf1a2ac099
- SHA1 76f5a51d8587aa411c6911e5580e196eb67041fd
- SHA512 e77c9926f90ccf75ba7d14b3918defc1e25bc4069812ac7e56e0e9fbd08705df691a8a18da8006ed6f43cd5b5f315c08fa0078a3bb654e5f8e161bc6053fae04
- SSDEEP 12288:WTEYAsROAsrt/uxduo1jB0Y96qEOoXNdcwSR1HYZyB2SzebZmlkMTee5MIeVpC2:WwT7rC6qEOuNUjHbBLaNXkeeNept
- TLSH T19205BF1137F68C29E6AD0334D4F566F08570A40D1762FBAB7AB47E6CBE1E3809912637
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
Resource
win10v2004-20260130-en
14 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luca-stealer_lynx_njrat_redline-stealer
- Size 821KB
- SHA256 99dacfaffe443309956d4ffa10b58e5c87de6c73339473712d9ade2cda57c923
- MD5 0040df58dec2a37687a885bf1a2ac099
- SHA1 76f5a51d8587aa411c6911e5580e196eb67041fd
- SHA512 e77c9926f90ccf75ba7d14b3918defc1e25bc4069812ac7e56e0e9fbd08705df691a8a18da8006ed6f43cd5b5f315c08fa0078a3bb654e5f8e161bc6053fae04
- SSDEEP 12288:WTEYAsROAsrt/uxduo1jB0Y96qEOoXNdcwSR1HYZyB2SzebZmlkMTee5MIeVpC2:WwT7rC6qEOuNUjHbBLaNXkeeNept
- TLSH T19205BF1137F68C29E6AD0334D4F566F08570A40D1762FBAB7AB47E6CBE1E3809912637
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Detects Eternity stealer
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Eternity family
-
Modifies Windows Defender Real-time Protection settings
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Windows security modification