eternity | 9e1d41777db7a575942f2bb5cd83ee558257c8f1297adad8374f931e8458df03

General

Target
2026-09-29_5015a6c3b22f78a1675a013944fe21ee_amadey_cobalt-strike_elex_glassworm_luca-stealer_lynx_njrat_redline-stealer
Size 900KB
Sample260930-bmvbnawcra
SHA256 9e1d41777db7a575942f2bb5cd83ee558257c8f1297adad8374f931e8458df03
MD5 5015a6c3b22f78a1675a013944fe21ee
SHA1 ff0e20d0fbe0653a18bbdda7804989d46136a899
SHA512 b8e326a73b285e6627d5619f3c02abc54844e8efbdb8e4d56eb693bd3098eafb046d20d7d6f1589d05528d931d5ab9c75606b7945f6986efe88a3ba2faabd573
SSDEEP 12288:TTEYAsROAsrt/uxduo1jB0Y96qP5x+JExxV4RO1jqFL3P6iFTshrUmG2+shA0SGC:TwT7rC6qBUQ4/sh1ZPO0z9N+
TLSH
T1F815C00477DA8C33D65B433455E946F18A79F4282F72C3EB628477696E2D3C2D8A035B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-29_5015a6c3b22f78a1675a013944fe21ee_amadey_cobalt-strike_elex_glassworm_luca-stealer_lynx_njrat_redline-stealer
- Size 900KB
- SHA256 9e1d41777db7a575942f2bb5cd83ee558257c8f1297adad8374f931e8458df03
- MD5 5015a6c3b22f78a1675a013944fe21ee
- SHA1 ff0e20d0fbe0653a18bbdda7804989d46136a899
- SHA512 b8e326a73b285e6627d5619f3c02abc54844e8efbdb8e4d56eb693bd3098eafb046d20d7d6f1589d05528d931d5ab9c75606b7945f6986efe88a3ba2faabd573
- SSDEEP 12288:TTEYAsROAsrt/uxduo1jB0Y96qP5x+JExxV4RO1jqFL3P6iFTshrUmG2+shA0SGC:TwT7rC6qBUQ4/sh1ZPO0z9N+
- TLSH
  T1F815C00477DA8C33D65B433455E946F18A79F4282F72C3EB628477696E2D3C2D8A035B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion eternity persistence privilege_escalation stealer trojan execution
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer
  stealer
- Family: Eternity
  Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
  eternity
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects executables containing artifacts associated with disabling Widnows Defender
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen
- Disables Task Manager via registry modification
  defense_evasion
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
  Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
  defense_evasion
- Windows security modification
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2