원본 언어로만 콘텐츠 제공
class="post-article">

EternityStealer

Eternity Stealer .NET 63KB PE32. Confirmed by Eternity.exe internal string. ConfuserEx obfuscation (random namespace nhqiftpausgcgynnttjgxfqhlzyzmrh). AES-CBC encryption via AesCryptoServiceProvider + ICryptoTransform. Win32Clipboard + Clipboard Manager = cryptocurrency clipboard hijacking (replaces BTC/ETH addresses). Future timestamp = cracked builder distributed on forums. Multiple Base64 encoded AES keys/configs in binary.

위협 프로필
유형 Infostealer
프로그래밍 언어.NET/C#
C2 프로토콜HTTP/C2
첫 감지2022
대상 Kuresel
목적 / 기능
  • Credential Theft/Clipboard Hijack/Infostealer
이 패밀리에 대해 아직 확인된 C2 서버가 없습니다.

연구 보고서 (1)

Yüksek

EternityStealer 025e74a9 -- Eternity.exe Confirmed ConfuserEx AES Sifreleme Win32Clipboard Pano Hijack BTC ETH Kripto Degistirme AesCryptoServiceProvider ICryptoTransform | Yuksek

EternityStealer 025e74a9 .NET PE32 x86 63KB. Eternity.exe string ile onay. ConfuserEx obfuskasyon. AesCryptoServiceProvider AES-CBC. Win32Clipboard + Clipboard Manager BTC pano hijack.

보고서 읽기 →