Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/03/2026, 03:58
Behavioral task
behavioral1
Sample
2026-03-26_2b7ddd69dba983dc1285a529168a5ed9_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
Resource
win10v2004-20260130-en
7 signatures
150 seconds
General
- Target 2026-03-26_2b7ddd69dba983dc1285a529168a5ed9_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
- Size 811KB
- Sample260326-ej1wtafx2j
- SHA256 460a9caf4862cae7dc85369693c8cc0ed42da84285afd770a3a88ab8b2d18421
- MD5 2b7ddd69dba983dc1285a529168a5ed9
- SHA1 1b5f6afec11ba0a83594f5ae2052bdd32fa2e64c
- SHA512 cba3c552249b71f0b09721d8215eee46144012dd12e68c3050f35e9b9840c82b8f6ab436210e2f6734979d43e11a3d8ef6c3df96c1d790713369adfd2ed6c85a
- SSDEEP 12288:XTEYAsROAsrt/uxduo1jB0Y96q3qOoaYtAYToPtSxJ+mSlPooM46qrymy17jaBro:XwT7rC6q3jTYMPYGmSpR6qryb6r34
- TLSH T1BC05CF18FFD94C22CEBA133084A556E04A78F4161757D39F27A43BB8AD1E3A25D23277
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Eternity stealer 2 IoCs
resource yara_rule behavioral2/memory/3028-0-0x00000000008F0000-0x00000000009C2000-memory.dmp eternity_stealer behavioral2/memory/3028-7-0x000000001B710000-0x000000001B720000-memory.dmp eternity_stealer - Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
- Eternity family
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3028 2026-03-26_2b7ddd69dba983dc1285a529168a5ed9_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-03-26_2b7ddd69dba983dc1285a529168a5ed9_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-03-26_2b7ddd69dba983dc1285a529168a5ed9_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3028