Trustwave SpiderLabs discovered Eternidade Stealer, a Delphi‑compiled banking trojan distributed via a WhatsApp‑propagating worm and social engineering that steals contacts and delivers an MSI dropper which deploys credential‑stealing components. The campaign uses IMAP‑based dynamic C2 retrieval, localized Brazilian targeting, encrypted C2 commands, and overlay/keylogging capabilities. #Eternidade #Casbaneiro
Keypoints
- Researchers identified a new Delphi‑based stealer named Eternidade distributed through a WhatsApp worm that automates messaging, steals contacts, and sends malicious attachments.
- The initial dropper is an obfuscated VBScript that installs a Python WhatsApp worm and an MSI installer which deploys encrypted payloads and an AutoIt loader.
- Eternidade retrieves C2 addresses dynamically via IMAP using hardcoded email credentials, with a fallback hardcoded domain if IMAP retrieval fails.
- The MSI dropper performs environment checks (OS language = Brazilian Portuguese), AV/product enumeration, telemetry collection, and only activates payloads when banking/crypto windows are detected.
- Payloads include a Delphi injector performing process hollowing into svchost.exe and a stealer that enumerates windows, harvests credentials via overlays, keylogging, and exfiltrates data to C2.
- Data exfiltration and C2 communications use encrypted strings (custom decryption with key “edit1” and salt “MeuSaltPessoal#2024”) and support many remote commands (e.g., overlays, keylogging, file transfer, screenshots).
- Infrastructure analysis revealed multiple domains, IP clusters, and a Redirector System with geofencing that predominantly allowed Brazilian targets; panel logs showed global hits but few from Brazil.
MITRE Techniques
- [T1059] Command and Scripting Interpreter – VBA/VBScript and Python are used as initial stages and propagation scripts (“obfuscated VBScript… drops a batch file that downloads and executes payloads” and a “1,300+ line piece of Python script (whats.py) designed to automate WhatsApp messaging”).
- [T1190] Exploit Public-Facing Application – Abuse of WhatsApp Web APIs and wppconnect-w.js (“uses ‘WPP.contact.list()’… downloads this library from GitHub to gain programmatic access to WhatsApp”).
- [T1105] Ingress Tool Transfer – Downloader behavior in dropper that fetches payloads from C2 domains (“The payloads are downloaded from the threat actor’s C2”).
- [T1566] Phishing – Social engineering via personalized WhatsApp messages with time‑aware greetings and contact name insertion to distribute malicious files (“message template… greeting automatically adjusts based on the time of day… uses the contact’s actual name”).
- [T1071] Application Layer Protocol – C2 retrieval and communications via IMAP over SSL and HTTP POST for exfiltration (“Connect to the IMAP server via SSL (Port 993) using hardcoded credentials” and “sends collected system information via POST method to its C2”).
- [T1027] Obfuscated Files or Information – Encrypted strings and custom decryption routines to hinder analysis (“multiple encrypted strings used for C2 communications… decryption routine uses a hardcoded key ‘edit1’ and salt ‘MeuSaltPessoal#2024′”).
- [T1055] Process Injection – Process hollowing injector loads decrypted payload into svchost.exe (“injector performs process hollowing to run the final payload” into svchost.exe).
- [T1083] File and Directory Discovery – Scanning for .tda and .dmp files and enumerating installation folder to load operator files (“malware searches for .tda or .dmp files in the installation folder”).
- [T1496] Resource Hijacking / Abuse – Use of victim WhatsApp sessions and stolen contacts to propagate and expand victim pool (“obter_contatos()… allows the malware to steal victims’ entire WhatsApp contact lists” and “sends a message to all contacts… along with a personalized greeting, a malicious file”).
- [T1113] Screen Capture – Commands to take captures and send them to C2 (“other commands observed are: activating keylogging features, sending captures or files”).
- [T1204] User Execution – Relies on social engineering to have victims execute MSI or script attachments delivered via WhatsApp (“malicious file from the C2… sends a message… with a malicious file”).
Indicators of Compromise
- [File Hashes] VBScript and payload hashes – VBS hashes: e1779d9810ad39a45759c856cc85f1148a8f6601, e3e24d57163e04ac16a93a698d4c8051473bccb4.
- [File Hashes] Whats.py and payload hashes – whats.py: 8f3b5a0cecd4d50fc6eb52a627fe6a9179e71736, 167cc2d716bfebc440f14ff1affe7f99b8556f2e; payload: db5545b6136f1197fd5234695cdeff285a99208e, 03944933d662f4e96d43750aa29bd287685c6007.
- [Domains] C2 and distribution URLs – varegjopeaks[.]com/altor/teste_obscado[.]vbs, varegjopeaks[.]com/altor/whats.py, centrogauchodabahia123[.]com/altor/installer[.]msi, itrexmssl[.]com/jasmin/altor/receptor[.]php, serverseistemasatu[.]com, domimoveis1[.]com[.]br (fallback C2), and other domains listed.
- [IPs] Infrastructure IP addresses – examples: 103.84.176[.]107, 104.21.48[.]41, 162.120.71[.]56 (and additional IPs such as 185.169.234[.]139, 83.229.17[.]71, 140.99.164[.]172, 174.138.187[.]2).
- [File Names] Malicious files and scripts – whats.py (WhatsApp worm), installer.msi (MSI dropper), and obfuscated VBScript/teste_obscado.vbs.