MALICIOUS — 795_Win32.EternalRocks.bin

MALICIOUS — 795_Win32.EternalRocks.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the EternalRocks family. 4 of 38 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: fc75410aa8f76154f5ae8fe035b9a13c76f6e132077346101a0d673ed9f3a0dd
• SHA-1: 7ffc0e123e6111e558fb99844d3b317694e419b2
• MD5: 5e8e046cb09f73b1e02aa4ac69c5765e
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 1536:6ND3N2/M8lL6/m4iXYW4xtMsZ7jVp1voxq3ny:6ND3N2/tlQ3iXYW4xtMUXV3oyny
• TLSH: T1793A3BCC42ADA720C5B2CE126C40D9DC295A3C86F87A7F8C2F4CA5776195E77A83501B
• Submitted as: 795_Win32.EternalRocks.bin
• File type: pe · Size: 101888 bytes
• Verdict: malicious (98/100) · Family: EternalRocks

Detections (4 of 38 engines)

• capa (capabilities): execute via PowerShell
• ClamAV (daily): Win.Trojan.EternalRocks-6320066-0
• Microsoft Defender: Trojan:Win32/Eterock!pz
• Emsisoft (Emergency Kit): Gen:Heur.Variadic.A.348.1

MITRE ATT&CK

• T1059.001

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

• ClamAV (daily) flagged Win.Trojan.EternalRocks-6320066-0 (rule Win.Trojan.EternalRocks-6320066-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Eterock!pz (rule Trojan:Win32/Eterock!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Heur.Variadic.A.348.1 (rule Gen:Heur.Variadic.A.348.1) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: http://ubgdgno5eswkhmpy.onion - static signal, weight 0.35, confidence 0.60

Dynamic analysis (windows)

1 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• none

Embedded URLs

• http://ubgdgno5eswkhmpy.onion

Embedded domains

• system.io
• system.net
• myapplication.app
• ubgdgno5eswkhmpy.onion

Embedded IP addresses

• 1.0.0.0
• 2.0.0.0

File paths

• C:\Program
• C:\Users\tmc\Documents\Visual
• c:\windows\system32\netstat.exe
• C:\WINDOWS\system32\framedyn.dll
• C:\WINDOWS\system32\dllcache\framedyn.dll
• c:\windows\system32\netsh.exe

More EternalRocks samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report