🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


EternidadeStealer


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc
SHA3-384 hash: ed9067786c6abfd624a4e29e165a9a3528aa20780a8da8a298fcd9cbaea54b4b06b47babaa436e88322edda156fee3e4
SHA1 hash: c42e67d31046302733e85d19c51dd1f6b1aea798
MD5 hash: 16d293a445306e01abe6691361df539b
humanhash: winter-nuts-papa-nuts
File name:G3d5duio.msi
Download: download sample
Signature EternidadeStealer
Create hunting rule
File size:17'080'320 bytes
First seen:2026-11-05 13:17:21 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:se+VoIm/GrCWk0WImRdy3BhoBdx12Z9xq9Q+Oc1i3j8pH:seUod/GO11RdEhouZ7q9Qfai3Ap
TLSH T16B07338BF4675B65D1E9C1FA573EC2184535FDA01A22CC0A730FB3D662F3B9628911CA
TrID 83.7% (.MSI) Microsoft Windows Installer (454500/1/170)
11.2% (.MST) Windows SDK Setup Transform script (61000/1/5)
3.5% (.WPS) Kingsoft WPS Office document (alt.) (19502/3/2)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter johnk3r
Tags:0yc70i4vxz7m-cloudve-lat banker latam msi oficinadacapivara-top p79hbck1bsjf-cloudve-lat

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
BR BR
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/634b3c15-7e7e-43d3-b083-b66271bf18cb/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97401/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aec821462f3df3e73e2ac97
Tags:
shellcode phishing dropper crypted
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a file
Creating a process from a recently created file
Sending a custom TCP request
Possible injection to a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expired-cert fingerprint installer keylogger reconnaissance stealer
Link:
https://www.filescan.io/uploads/6aec8211c31b6da6fa170896/reports/e261a93f-f792-430b-b1c4-910c5b19b94f/overview
Verdict:
Malicious
Labled as:
ABTrojan.ROVP
Link:
https://www.hybrid-analysis.com/sample/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc
Verdict:
Malicious
File Type:
msi
First seen:
2026-09-16T08:46:00Z UTC
Last seen:
2026-10-22T08:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc/results?tab=lookup
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1998988
Signature
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Multi AV Scanner detection for submitted file
Sigma detected: New RUN Key Pointing to Suspicious Folder
Suricata IDS alerts for network traffic
Tries to delay execution (extensive OutputDebugStringW loop)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998988 Sample: G3d5duio.msi Startdate: 05/11/2026 Architecture: WINDOWS Score: 76 45 oficinadacapivara.top 2->45 47 api.ipify.org 2->47 61 Suricata IDS alerts for network traffic 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 Sigma detected: New RUN Key Pointing to Suspicious Folder 2->65 9 msiexec.exe 85 41 2->9         started        12 audiodg_svc.exe 1 2->12         started        14 audiodg_svc.exe 1 2->14         started        16 msiexec.exe 3 2->16         started        signatures3 process4 file5 37 C:\Users\user\AppData\...\audiodg_svc.exe, PE32 9->37 dropped 39 C:\Users\user\AppData\Local\...\msiexec.log, ASCII 9->39 dropped 41 C:\Users\user\AppData\Local\...\ssleay32.dll, PE32 9->41 dropped 43 2 other files (none is malicious) 9->43 dropped 18 audiodg_svc.exe 1 9->18         started        21 msiexec.exe 1 9->21         started        23 audiodg_svc.exe 12->23         started        25 audiodg_svc.exe 14->25         started        process6 signatures7 53 Tries to delay execution (extensive OutputDebugStringW loop) 18->53 27 audiodg_svc.exe 5 1 18->27         started        31 RegSvcs.exe 3 23->31         started        55 Writes to foreign memory regions 25->55 57 Allocates memory in foreign processes 25->57 59 Injects a PE file into a foreign processes 25->59 33 RegSvcs.exe 3 25->33         started        process8 dnsIp9 49 oficinadacapivara.top 172.67.222.132, 443, 49739 CLOUDFLARENET-CloudflareIncUS Canada 27->49 51 api.ipify.org 172.67.74.152, 443, 49738 CLOUDFLARENET-CloudflareIncUS Canada 27->51 67 Writes to foreign memory regions 27->67 69 Allocates memory in foreign processes 27->69 71 Injects a PE file into a foreign processes 27->71 35 RegSvcs.exe 2 3 27->35         started        signatures10 process11
Verdict:
Malware
YARA:
5 match(es)
Tags:
CAB:COMPRESSION:MSZIP COM Behavior Trace DeObfuscated Executable Obfuscated Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) SOS: 0.17 T1027 T1059.005 VBScript WScript.Shell
Link:
https://app.malva.re/file/16d293a445306e01abe6691361df539b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc/
Threat name:
Script-AutoIt.Infostealer.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-09-16 01:28:53 UTC
File Type:
Binary (Archive)
Extracted files:
37
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wobdk2bunjvk6wz37pnv5s65vbz2eewfjl4nftii352aqkpfdpoa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261105-qjz53acx7l/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
NTFS ADS
Script User-Agent
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Adds Run key to start application
Enumerates connected drives
Looks up external IP address via web service
Executes dropped EXE
Malware Family:
n/a
Verdict:
Suspicious
Tags:
rat
YARA:
Wscript
Link:
https://app.threat.zone/submission/80be91f7-49e1-44d7-83f9-8d7b74d3ad7b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

EternidadeStealer

Visual Basic Script (vbs) vbs c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977

EternidadeStealer

Microsoft Software Installer (MSI) msi b3823568346a6aaf5b3bfbdb5ecbdda873a212c54af8d2cd08df740829e51bdc

(this sample)

EternidadeStealer

Executable exe d63368fce09598cb938ba48d4add2432ab8a62607e2c7c688f6d1f81341dd38f

Cape
Cape
https://www.capesandbox.com/analysis/97401/
  
Dropped by
SHA256 c97ee9d7a7d3651ddd322f2bcd855175a6ea92d994e8aca722add0c6fe4eb977
  
Dropped by
MD5 57afe35e797de9ab6b2668c44cfb3df0
  
Dropping
SHA256 d63368fce09598cb938ba48d4add2432ab8a62607e2c7c688f6d1f81341dd38f
  
Dropping
MD5 9117aa735747cfcdfb01f5c93023a103
  
Dropping
SHA256 1b2c3e80347b35fb5811619f3aeae75f05dd4e635ffef7620141be7ed3041eb3
  
Dropping
MD5 245cfa3320aa52e2bbed542e4475b55d

Comments