eimeria | c872cd101d9c2a773f08558dde7b716161cf977d4aa99c2347c0269423434f8c

Sharing

Copy URL Twitter E-mail

General

Target
c872cd101d9c2a773f08558dde7b716161cf977d4aa99c2347c0269423434f8c
Size 5.2MB
Sample260508-n6jeqagv2w
SHA256 c872cd101d9c2a773f08558dde7b716161cf977d4aa99c2347c0269423434f8c
MD5 d35d8e0c2677949b7d3636c179d41cc1
SHA1 4c87db3b1dea4551413ba4d052f8e247a1b64fc1
SHA512 7e83e25bfa38fbefb0f9b8675b03cefb726acc2595761c48ad434f9ab8e9b7fb8b89d3d2eefb04e0aabf289c09e8e997a1c5de0d0c8681552f65db8816e7ad15
SSDEEP 98304:o1/o3ikTBfoJFawvWl1CT/pzQAyusBfE+7/BGW:ou3MJFajlE1zQArQZGW
TLSH
T1FF4633F5AC695F240732EBF3E3D47BAA07D339E2C906669A568D0B4510E7CCA7AD0D40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

eimeria

ws://94.26.90.139:3006

Targets

- Target
  jjez/dsclock.exe
- Size 1.6MB
- SHA256 62fdad7df8fd7bc2b211c2de06c002831b36987b48a943758432f25006661578
- MD5 d65fe05a3bee25edf755a4bdb8fe1a91
- SHA1 db5aeb0d1554f53c2eab67243251383ccfdb7c6f
- SHA512 7877cb43983be01732480da9796e13e6a48312602edef45b84c14ece777e64a7f08d97d6db036b6cb491212c3ae3a1164faa309da132b598b0a2cfde1d5ef525
- SSDEEP 24576:ao8Yh5f/OwtXTGjlouCP5nFk5YlLw53AHcMmpIfm7gYzfrnerQw+:/5PD/uCP55L0AHcMmpIfif7YQw+
- TLSH
  T107758D253785C136E1220272AA6DBB66D2EDBD306B75AAC7B3C81E0D1E715C35A30737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery eimeria persistence rat
- Family: Eimeria
  Eimeria is a Windows RAT written in C++.
  rat eimeria
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  jjez/libcurl.dll
- Size 354KB
- SHA256 94f503e2263bdd852a6a88ade9fb4b006312760d9a7bddb69f9b2692313082d5
- MD5 ff51047587a4f042e074d61d7596d96e
- SHA1 2e54ec7433bf47913212c55180cf9903ddbb9a9a
- SHA512 60e1c7d56132b55ae434875893324f497cbf8c3b84244dec030e8b64ae0ce5e3aa31eb6c4d9255a21f8dda32c8b7b08129677fcafc334c9a5455f5f09fd506e4
- SSDEEP 6144:0+bg9HDAY61iuGYCgdwFC91bEr7YkY4CzhEzX+K6sioo68MrjooMXJbWTpwT0H3b:0NHDgiunCgdwFC91bEr7YkY4CzhEzX+Y
- TLSH
  T15574AE80AF80D0F2E1822278A527DB771D7DA115233BC5C3EBD45E646F34AE1A67938D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  jjez/msbuilder64.dll
- Size 4.4MB
- SHA256 e155acf50ab0dad1a80f0a67d396d0ad5691fc9e314e4efd1da1dd3180c9632f
- MD5 6c7aaf4b7e4aba7d86c0f079c982a666
- SHA1 f6f627003f32d6d900de4a338777aef1d8727751
- SHA512 e40003dfff9d18dc5ffa26964d6179b5d861eb29e9b4e8f28c499d922e334b3b25ada84e3b1118048dd2998c180a3092d9665b40e0dd021aa2790db212b1cfb0
- SSDEEP 49152:kzt49k+yihDVifepJ3k+T0vwvWlGrIz22q/pz7NXS6ot+inYktjJI/ElGIBXHwsE:4ikTBfoJFawvWl1CT/pzQAyusBfE+7/C
- TLSH
  T1582633F9AC159F180B31EAFB97947E9B43C33DD3D94762EA069E064514EBDCA6AD0C00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  jjez/zlibwapi.dll
- Size 91KB
- SHA256 53abc3c2f3e919ecd84724439b4d4fb679857316c6af91987e6db1dde9e8a198
- MD5 f8a9f400ee56eb3bb2d539fa662b60da
- SHA1 9d8b0d11d94693b9db017ba9f3b931c6d4987253
- SHA512 b4cca337f31c6d7ba11f977aaba21a2ce41b6a4240a4eb284ddc124e924009b47bbfb018e4c39c00edaff12f9f4753b609f3a726f40d25eb5f376b8bfd903d64
- SSDEEP 1536:yowPQkRjFlBUgqLN0cEOrjgmPN7ctj3ObXT8Kog3sWicdwuC44chaG/x:9wPBjFIN3rjXYtj3OcKoSw1tG5
- TLSH
  T1D7937D01B4E0C079D57D443A0824D6F25B7E7860DFA29DDF37991BAA4E702C2EE35D2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery eimeria persistence rat
- Family: Eimeria
  Eimeria is a Windows RAT written in C++.
  rat eimeria
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Eimeria

Adds Run key to start application

Suspicious use of SetThreadContext

Family: Eimeria

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8