Overview

overview

10

Static

static

f0ca23d101...89.exe

windows7_x64

8

f0ca23d101...89.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f0ca23d101868cd75aed85f10eda2c0067e7de7f81f84eee0232e9cd5f319889

  • Size

    978KB

  • Sample

    201106-ws86fm3dgs

  • MD5

    6e8498b91bf1a607f76bc04b2ad2fa70

  • SHA1

    95e1904c2f67cd364b8b386e5ccdd33edcd4955c

  • SHA256

    f0ca23d101868cd75aed85f10eda2c0067e7de7f81f84eee0232e9cd5f319889

  • SHA512

    00553a4611ec8badd707471ca53cebdc6cb876043a2e52522fb058369c228cfcf9fadb105795177bec50cc181c54879ab3cab74009ed2828ea96268c3dbcd172

Score
10/10
echelondiscoveryspywarestealer

Malware Config

Targets

    • Target

      f0ca23d101868cd75aed85f10eda2c0067e7de7f81f84eee0232e9cd5f319889

    • Size

      978KB

    • MD5

      6e8498b91bf1a607f76bc04b2ad2fa70

    • SHA1

      95e1904c2f67cd364b8b386e5ccdd33edcd4955c

    • SHA256

      f0ca23d101868cd75aed85f10eda2c0067e7de7f81f84eee0232e9cd5f319889

    • SHA512

      00553a4611ec8badd707471ca53cebdc6cb876043a2e52522fb058369c228cfcf9fadb105795177bec50cc181c54879ab3cab74009ed2828ea96268c3dbcd172

    Score
    10/10
    echelondiscoveryspywarestealer

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Echelon log file

      Detects a log file produced by Echelon.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks