MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


EternityStealer


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf
SHA3-384 hash: 00ef599f7da725295ec176b1a9c56f14f8a39f63413afc1c29644878fee346b9ffecf1fec2cbea3473dac7cd91e72e4b
SHA1 hash: e7913e7dcdfc9be3a51bbd67a8e0e807b63bc33d
MD5 hash: d16f7b6510caf611ce85f0488ae0a65d
humanhash: mike-tennessee-wisconsin-mirror
File name:Worm.exe
Download: download sample
Signature EternityStealer
Create hunting rule
File size:1'355'776 bytes
First seen:2022-11-25 20:46:43 UTC
Last seen:2022-11-25 22:32:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'665 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:fgEdnkH+O5MMsj/8oJ0HOgwzMIdEyaXC772Q9NXw2/wPOjdGxY:fgEuHZ5MMpoJOp+MIVai7Tq24GjdGS
Threatray 69 similar samples on MalwareBazaar
TLSH T17955235877748E3AE2E4303D84775334C3A003265F53B78AAB1575A13E52E6E8E436EB
TrID 30.6% (.SCR) Windows screen saver (13097/50/3)
24.5% (.EXE) Win64 Executable (generic) (10523/12/4)
15.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win32 Executable (generic) (4505/5/1)
4.8% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter CryptoInsane
Tags:EternityStealer exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
186
Origin country :
PE PE
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Worm.exe
Verdict:
Malicious activity
Analysis date:
2022-11-25 20:48:45 UTC
Tags:
opendir loader
Link:
https://app.any.run/tasks/1d2b9d31-59f1-4cc8-bccd-92cc67abe933

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/338600/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.19031.23689.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a process from a recently created file
Sending an HTTP GET request
Creating a file in the %temp% directory
DNS request
Moving a recently created file
Deleting a recently created file
Replacing files
Moving a file to the %temp% directory
Creating a window
Modifying an executable file
Unauthorized injection to a recently created process
Creating a file in the mass storage device
Enabling autorun by creating a file
Infecting executable files
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
hacktool packed
Link:
https://www.filescan.io/uploads/638129c75be128ac718ee159/reports/cc8da5ef-b32a-4205-b46c-488f3f14d80a/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Tandem Espionage
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6790eff0-17be-45cc-a070-a5c7af996004
Result
Threat name:
Eternity Worm, XWorm
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1121366
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Drops PE files to the document folder of the user
Found Tor onion address
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Costura Assembly Loader
Yara detected Eternity Worm
Yara detected XWorm
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 754083 Sample: Worm.exe Startdate: 25/11/2022 Architecture: WINDOWS Score: 100 55 Malicious sample detected (through community Yara rule) 2->55 57 Antivirus detection for dropped file 2->57 59 Multi AV Scanner detection for dropped file 2->59 61 8 other signatures 2->61 7 Worm.exe 5 2->7         started        11 Worm.exe 11 2->11         started        13 Worm.exe 2->13         started        process3 file4 37 C:\Users\user\AppData\Local\...\Worm.exe, PE32 7->37 dropped 39 C:\Users\user\...\Worm.exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\user\AppData\Local\...\Worm.exe.log, ASCII 7->41 dropped 67 Self deletion via cmd or bat file 7->67 15 cmd.exe 1 7->15         started        43 C:\Users\user\AppData\...\tmp781D.tmp.exe, PE32 11->43 dropped 45 C:\Users\user\AppData\...\tmp674.tmp.exe, PE32 11->45 dropped 47 C:\Users\user\AppData\Local\Temp\tmp615.tmp, PE32 11->47 dropped 49 3 other malicious files 11->49 dropped signatures5 process6 signatures7 69 Uses schtasks.exe or at.exe to add and modify task schedules 15->69 71 Uses ping.exe to check the status of other devices and networks 15->71 18 Worm.exe 15 484 15->18         started        23 PING.EXE 1 15->23         started        25 conhost.exe 15->25         started        27 2 other processes 15->27 process8 dnsIp9 51 140.82.34.147, 49698, 80 AS-CHOOPAUS United States 18->51 29 C:\Users\user\Documents29IRMEKAMZH.exe, PE32 18->29 dropped 31 C:\Users\user\Documents\LFOPODGVOH.exe, PE32 18->31 dropped 33 C:\Users\...\LFOPODGVOH-mgz.3pm.scr (copy), PE32 18->33 dropped 35 493 other malicious files 18->35 dropped 63 Drops PE files to the document folder of the user 18->63 65 Modifies existing user documents (likely ransomware behavior) 18->65 53 127.0.0.1 unknown unknown 23->53 file10 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-11-25 20:47:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=36apvzpkgnnetx2wvbrn7sd66hcej4njyi6rhtcvsmfzyutyhdhq._file
Verdict:
malicious
Similar samples:
21ac1216673e162cc396584817355de87662f0855231863cb883fa6d447f1be7
EternityStealer
2643cf9a55c2658f27c063bbb5092795a2c439d0f47bf2e4df6e73f74a15b0d3
EternityStealer
65c863db26f4ad804cb65ecf86f5d3b0b7dc961979544fe059192f6caab4c861
EternityStealer
757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
EternityStealer
7c0790ce5a7cfd7a3ab0af70a4766b7003bdf8eb2e366f5c74f609c57c34f4bb
EternityStealer
b4ac41c87a05e54cdd6b31132994860cf61bc0ab2f04a8c7ff65ef3f585becf5
EternityStealer
e7f968d64655db242cdc6330cf399c3b5e635b63b2ba734d5e2c2eee5986e9be
EternityStealer
e86174e025e61e09387c8f93943bd0622cf2e1556dfc0ff6f0e858b7b9d911e7
EternityStealer
f1c5be0df761f43d265a1e7057f59a05b1f78f3bafabd7a9145fe195fc6db97a
EternityStealer
fd64e524e0f85d83e28e36f15bcb4033b508abcb3695c02612f56e4122b8beb7
EternityStealer
+ 59 additional samples on MalwareBazaar
Result
Malware family:
eternity
Create hunting rule
Score:
  10/10
Tags:
family:eternity
Link:
https://tria.ge/reports/221125-zkvreagh5y/
Behaviour
Creates scheduled task(s)
Runs ping.exe
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Deletes itself
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Eternity
Malware Config
C2 Extraction:
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/20f4c885-213a-4766-9869-3ae94e19e816
Unpacked files
SH256 hash:
a36e5c8960f27edfe6faac02d2b5912317dce0b9ab558378680303e1b15503de
MD5 hash:
90261f729f296a8a65488286f9c52df1
SHA1 hash:
a75e01a587ba922b186d9eab167bddfcd29decc5
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
SH256 hash:
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
MD5 hash:
944ce5123c94c66a50376e7b37e3a6a6
SHA1 hash:
a1936ac79c987a5ba47ca3d023f740401f73529b
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
SH256 hash:
48f144f744a9ce60659ee8cc7094610252aecbabf95492fbc612db919d144918
MD5 hash:
d9e08ec1c571d8139255cf305e3fef40
SHA1 hash:
72aea7c18c901a3246eb276258e3b37a95048b4e
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
SH256 hash:
41d6a6098f47965744ef7360058c8fb6a8eba472aec9ad5c6b711fed3c47f52e
MD5 hash:
866c6b089cc2d65f63e55883f2cdbe41
SHA1 hash:
436dbc9b91c7e40dfb09a45193f1aefd912c8ddc
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
SH256 hash:
74487c5961978bdf9479435d511b7681f1d25488fcf68b3f4c58bbae799e8d59
MD5 hash:
8536a024476abd1035ea74478ed46e1e
SHA1 hash:
de08909e721dd6d64c5f975f1bf978526da9aadb
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
SH256 hash:
df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf
MD5 hash:
d16f7b6510caf611ce85f0488ae0a65d
SHA1 hash:
e7913e7dcdfc9be3a51bbd67a8e0e807b63bc33d
Link:
https://www.unpac.me/results/479d5ee1-c598-4dfa-b6ee-bb7876c24bfe/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df80fae5ea33/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/df80fae5ea335a49df56a862dfc87ef1c444f1a9c23d13cc55930b9c527838cf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/338600/

Comments