EternityStealer
Eternity Stealer .NET 63KB PE32. Confirmed by Eternity.exe internal string. ConfuserEx obfuscation (random namespace nhqiftpausgcgynnttjgxfqhlzyzmrh). AES-CBC encryption via AesCryptoServiceProvider + ICryptoTransform. Win32Clipboard + Clipboard Manager = cryptocurrency clipboard hijacking (replaces BTC/ETH addresses). Future timestamp = cracked builder distributed on forums. Multiple Base64 encoded AES keys/configs in binary.
Tehdit Profili
Tür
Infostealer
Yazılım Dili.NET/C#
C2 ProtokolüHTTP/C2
İlk Görülme2022
Hedef Kitle
Kuresel
Amaç / Yetenekler
- Credential Theft/Clipboard Hijack/Infostealer
Bu aile için henüz C2 sunucusu tespit edilmemiştir.
Araştırma Raporları (1)
EternityStealer 025e74a9 -- Eternity.exe Confirmed ConfuserEx AES Sifreleme Win32Clipboard Pano Hijack BTC ETH Kripto Degistirme AesCryptoServiceProvider ICryptoTransform | Yuksek
EternityStealer 025e74a9 .NET PE32 x86 63KB. Eternity.exe string ile onay. ConfuserEx obfuskasyon. AesCryptoServiceProvider AES-CBC. Win32Clipboard + Clipboard Manager BTC pano hijack.
Raporu Oku →