Eternity Clipper

Rule Signatures
1

Hi! Check out new tweet on this threat ➷
And of course I propose rules for the clipper✎

alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] EternityClipper (Successful Installation)";flow: established, to_server; http.uri;content: "?install=";content: "&wallets="; distance: 0;content: "&user="; distance: 0;content: "&comp="; distance: 0;content: "&ip="; distance: 0;content: "&country="; distance: 0;content: "&city="; distance: 0; http.user_agent;content: "OnionWClient";classtype: trojan-activity;reference: md5,e94cbfc023e1e1c5da6d44d719b50319;reference: url,app.any.run/tasks/dc98848c-5576-43c2-af7f-35bd83a7aa2a; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family EternityClipper,  created_at 2023_09_22;sid: 1; rev: 1;)

alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] EternityClipper (Address Change)";flow: established, to_server; http.uri;content: "?currency=";content: "&from="; distance: 0; content: "&to="; distance: 0; content: "&user="; distance: 0; content: "&comp="; distance: 0; content: "&ip="; distance: 0; content: "&country="; distance: 0; content: "&city="; distance: 0; http.user_agent;content: "OnionWClient";classtype: trojan-activity;reference: md5,e94cbfc023e1e1c5da6d44d719b50319;reference: url,app.any.run/tasks/dc98848c-5576-43c2-af7f-35bd83a7aa2a;metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family EternityClipper,  created_at 2023_09_22;sid: 2; rev: 1;)

And I also suggest renaming ET MALWARE Win32/Eternity Activity (POST) to Eternity Stealer or add a new one.

image
image1426×810 97.5 KB

It is similar to a clipper but contains /stld in the URI.
Sends ~90 kb in this example.

Best regards, Jane ☾⋆｡𖦹 °✩

1 Like
2

Heya @Jane0sint !

I’ve got your new sigs in and they’ll go out in tomorrow’s release. I also renamed sid 2042517 - Win32/Eternity Stealer Activity (POST) to be consistent with your two new signatures.

:smiley_cat:

1 Like
3

Thanks @Jane0sint @ishaughnessy !

2 Likes
5 
2048260 - ET MALWARE [ANY.RUN] Win32/EternityClipper CnC Activity (Successful Installation) (POST)
2048261 - ET MALWARE [ANY.RUN] Win32/EternityClipper CnC Activity (Address Change) (POST)

✿ڿڰۣ—

1 Like
6

Thanks for adding the correct signatures… copy/paste from my phone did not work well :see_no_evil:

2 Likes