MalwareUsed by 1 actorExploits 1 CVE

EternalRocks

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

It spreads through public (The Shadow Brokers NSA dump) SMB exploits: ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE and ETERNALSYNERGY

via github webgithub.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BackdoorDiplomacy

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.001MalwareEvidence2

Adversaries may buy, steal, or download malware that can be used during targeting.

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

Two scheduled tasks ServiceHost and TaskHost having multiple triggers ... ServiceHost -> C:\Program Files\Microsoft Updates\svchost.exe # system start, log on, daily TaskHost -> C:\Program Files\Microsoft Updates\taskhost.exe # system start, log on, daily

T1059.003Windows Command ShellEvidence1

it leaves PC vulnerable to remote commands for future attacks.

T1059.005Visual BasicEvidence1

8ef751c540fdc6962ddc6799f35a907c # older (VB6) variants of UpdateInstaller.exe

T1203Exploitation for Client ExecutionEvidence1

And discovered that it uses 7 NSA tools via SMB to perform attack: EternalBlue, EternalChampion, EternalRomance, EternalSynergy, DoublePulsar, ArchiTouch, SmbTouch.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence1

EternalRocks disguises itself as WannaCry to fool researchers.

T1497.003Time Based ChecksEvidence1

According to Stampar, the second stage comes with a delay of 24 hours in an attempt to avoid sandboxing techniques, making the worm infection undetectable.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence2

After that, starts a random scan of opened 445 (SMB) ports on Internet

T1497.003Time Based ChecksEvidence1

According to Stampar, the second stage comes with a delay of 24 hours in an attempt to avoid sandboxing techniques, making the worm infection undetectable.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

And discovered that it uses 7 NSA tools via SMB to perform attack... All the seven SMB (Server Message Block) exploits are then downloaded to the infected computer. EternalRocks then scans the internet for open SMB ports to spread itself to other vulnerable systems as well.

T1210Exploitation of Remote ServicesEvidence1

It spreads through public SMB exploits: ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE and ETERNALSYNERGY

Collection

1 technique

T1560Archive Collected DataEvidence1

After initial run it drops the exploit pack shadowbrokers.zip and unpacks contained directories payloads/, configs/ and bins/.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Second stage malware taskhost.exe ... is being downloaded after a predefined period (24h) from http://ubgdgno5eswkhmpy.onion/updates/download?id=PC and run.

T1090.003Multi-hop ProxyEvidence2

Component svchost.exe is used for downloading, unpacking and running Tor from archive.torproject.org along with C&C (ubgdgno5eswkhmpy.onion) communication requesting further instructions

T1105Ingress Tool TransferEvidence2

First stage malware UpdateInstaller.exe ... downloads necessary .NET components ... from Internet, while dropping svchost.exe and taskhost.exe.

INDICATORS OF COMPROMISE

IOCs tracked for this family

31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

29 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

hash.md5●●●●●●●●●●●●View more in app9 years ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

mitre attack websiteNews

Oct 31, 2024

Obtain Capabilities: Malware, Sub-technique T1588.001 - Enterprise | MITRE ATT&CK®

Leaked malware used in threat actor operations.

mitre attack websiteNews

Oct 1, 2020

Obtain Capabilities: Malware, Sub-technique T1588.001 - Enterprise | MITRE ATT&CK®

A leaked malware capability referenced as used in operations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching31

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

EternalRocks

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionExploited in the wild

It spreads through public (The Shadow Brokers NSA dump) SMB exploits: ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE and ETERNALSYNERGY

via github webgithub.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

BackdoorDiplomacy

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

via mitre attack websiteattack.mitre.org

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.001MalwareEvidence2

Adversaries may buy, steal, or download malware that can be used during targeting.

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

T1059.003Windows Command ShellEvidence1

it leaves PC vulnerable to remote commands for future attacks.

T1059.005Visual BasicEvidence1

8ef751c540fdc6962ddc6799f35a907c # older (VB6) variants of UpdateInstaller.exe

T1203Exploitation for Client ExecutionEvidence1

And discovered that it uses 7 NSA tools via SMB to perform attack: EternalBlue, EternalChampion, EternalRomance, EternalSynergy, DoublePulsar, ArchiTouch, SmbTouch.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence1

EternalRocks disguises itself as WannaCry to fool researchers.

T1497.003Time Based ChecksEvidence1

According to Stampar, the second stage comes with a delay of 24 hours in an attempt to avoid sandboxing techniques, making the worm infection undetectable.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence2

After that, starts a random scan of opened 445 (SMB) ports on Internet

T1497.003Time Based ChecksEvidence1

According to Stampar, the second stage comes with a delay of 24 hours in an attempt to avoid sandboxing techniques, making the worm infection undetectable.

Lateral Movement

2 techniques

T1021Remote ServicesEvidence1

T1210Exploitation of Remote ServicesEvidence1

It spreads through public SMB exploits: ETERNALBLUE, ETERNALCHAMPION, ETERNALROMANCE and ETERNALSYNERGY

Collection

1 technique

T1560Archive Collected DataEvidence1

After initial run it drops the exploit pack shadowbrokers.zip and unpacks contained directories payloads/, configs/ and bins/.

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Second stage malware taskhost.exe ... is being downloaded after a predefined period (24h) from http://ubgdgno5eswkhmpy.onion/updates/download?id=PC and run.

T1090.003Multi-hop ProxyEvidence2

Component svchost.exe is used for downloading, unpacking and running Tor from archive.torproject.org along with C&C (ubgdgno5eswkhmpy.onion) communication requesting further instructions

T1105Ingress Tool TransferEvidence2

First stage malware UpdateInstaller.exe ... downloads necessary .NET components ... from Internet, while dropping svchost.exe and taskhost.exe.

INDICATORS OF COMPROMISE

IOCs tracked for this family

31 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

29 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

hash.md5●●●●●●●●●●●●View more in app9 years ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

mitre attack websiteNews

Oct 31, 2024

Obtain Capabilities: Malware, Sub-technique T1588.001 - Enterprise | MITRE ATT&CK®

Leaked malware used in threat actor operations.

mitre attack websiteNews

Oct 1, 2020

Obtain Capabilities: Malware, Sub-technique T1588.001 - Enterprise | MITRE ATT&CK®

A leaked malware capability referenced as used in operations.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching31

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.