MALICIOUS — 778_Win32.EternalRocks.bin

MALICIOUS — 778_Win32.EternalRocks.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Eternalrocks1 family. 7 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 9bd32162e0a50f8661fd19e3b26ff65868ab5ea636916bd54c244b0148bd9c1b
• SHA-1: 1cbc9d531ba0e5e67a1ada95cff19bf0020f88f8
• MD5: b7cf3852a0168777f8856e6565d8fe2e
• imphash: f051371b13a6ad83d52e4fb619d303a0
• ssdeep: 3072:2GNI7tj1WtGRPHNDdNSktLjiXYWcqtsvGFVvouFy:pN+PNDdx/HQ
• TLSH: T1333E4BCD46ADAB20C572CE127C40D5EC249A3882B97A7B8C2F48A57762D1D379C3506F
• Submitted as: 778_Win32.EternalRocks.bin
• File type: pe · Size: 139264 bytes
• Verdict: malicious (99/100) · Family: Eternalrocks1

Detections (7 of 52 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): {MD5}bin.trojan.eternalrocks1.7933.UNOFFICIAL
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• Microsoft Defender: Trojan:Win32/Eterock.A
• Emsisoft (Emergency Kit): Gen:Variant.Fragtor.127925
• Kaspersky (KVRT): Trojan.Win32.Reconyc.hxvw

MITRE ATT&CK

• T1059.001
• T1071.001

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.eternalrocks1.7933.UNOFFICIAL (rule {MD5}bin.trojan.eternalrocks1.7933.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Eterock.A (rule Trojan:Win32/Eterock.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Fragtor.127925 (rule Gen:Variant.Fragtor.127925) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Reconyc.hxvw (rule Trojan.Win32.Reconyc.hxvw) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, http://ubgdgno5eswkhmpy.onion - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 4 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6133/files/d820112486449ccfe67b3d361e1d788d373e8f3c4dd5a32523ca456321adaf85 - d820112486449ccfe67b3d361e1d788d373e8f3c4dd5a32523ca456321adaf85
• /opt/CAPEv2/storage/analyses/6133/files/761fc0c5be08228c397d1a1855ec73e50121bd5a15dd5ebfa9c7e46215d880b7 - 761fc0c5be08228c397d1a1855ec73e50121bd5a15dd5ebfa9c7e46215d880b7
• /opt/CAPEv2/storage/analyses/6133/files/56cdbca76464635121346499c237e17be0239d177db1b5fd7334430a200ec38d - 56cdbca76464635121346499c237e17be0239d177db1b5fd7334430a200ec38d
• /opt/CAPEv2/storage/analyses/6133/files/2863e83f8a38028007d836365e912bc23d49930f66c77b3d103283becc8bcd9b - 2863e83f8a38028007d836365e912bc23d49930f66c77b3d103283becc8bcd9b

Embedded URLs

• http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• http://download.microsoft.com/download/a/3/f/a3f1bf98-18f3-4036-9b68-8e6de530ce0a/NetFx64.exe
• http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe
• http://ubgdgno5eswkhmpy.onion

Embedded domains

• api.nuget.org
• download.microsoft.com
• ubgdgno5eswkhmpy.onion

File paths

• C:\Program
• C:\Users\tmc\Documents\Visual
• c:\Program
• c:\windows\system32\netstat.exe
• C:\WINDOWS\system32\framedyn.dll
• C:\WINDOWS\system32\dllcache\framedyn.dll
• c:\windows\system32\netsh.exe

More Eternalrocks1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report