Overview

overview

10

Static

static

Build111.exe

windows7_x64

10

Build111.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Build111.exe

  • Size

    1.2MB

  • Sample

    200804-b3v9rnfjde

  • MD5

    71d8f70fcd46f5d2a88a2f9d40cebf38

  • SHA1

    300bcbbfd56740f21e1af62f0a4b67df4bdfffd3

  • SHA256

    36f7bb3f776e1b4d97a2cf8cd65aac04593a797a8d46936d0900041995020465

  • SHA512

    8e86ad7493c5cd742c7212db0743323f1bc21ebd153b9fa56625b32c914a5a17817a91615f423d3e55dc2b5138e98b05eabed2730bd6f9a186b7beff53f13391

Score
10/10
echelondiscoveryspywarestealer

Malware Config

Targets

    • Target

      Build111.exe

    • Size

      1.2MB

    • MD5

      71d8f70fcd46f5d2a88a2f9d40cebf38

    • SHA1

      300bcbbfd56740f21e1af62f0a4b67df4bdfffd3

    • SHA256

      36f7bb3f776e1b4d97a2cf8cd65aac04593a797a8d46936d0900041995020465

    • SHA512

      8e86ad7493c5cd742c7212db0743323f1bc21ebd153b9fa56625b32c914a5a17817a91615f423d3e55dc2b5138e98b05eabed2730bd6f9a186b7beff53f13391

    Score
    10/10
    echelondiscoveryspywarestealer

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Echelon log file

      Detects a log file produced by Echelon.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks