Overview

overview

10

Static

static

Output.exe

windows7_x64

10

Output.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Output.exe

  • Size

    1.2MB

  • Sample

    210216-kqt26hf492

  • MD5

    3ee3964b6d55f0657fffcf7594f9309f

  • SHA1

    7e4cb727fdc895d4497ffd0d83b810fed8a880dc

  • SHA256

    b5a96378e32e7b20fd73fe5f634729280684bbb146f183b80751680a0e42191d

  • SHA512

    81cdb9d4cf9ba6f3e04e1ec59cf817d0ef54a8d4a135e7018b4045243f7d1d1bb3f3143500a8a5bdf643d879f510450bc14a71715177072eea9a3be833e9d896

Score
10/10
echelondiscoveryspywarestealer

Malware Config

Targets

    • Target

      Output.exe

    • Size

      1.2MB

    • MD5

      3ee3964b6d55f0657fffcf7594f9309f

    • SHA1

      7e4cb727fdc895d4497ffd0d83b810fed8a880dc

    • SHA256

      b5a96378e32e7b20fd73fe5f634729280684bbb146f183b80751680a0e42191d

    • SHA512

      81cdb9d4cf9ba6f3e04e1ec59cf817d0ef54a8d4a135e7018b4045243f7d1d1bb3f3143500a8a5bdf643d879f510450bc14a71715177072eea9a3be833e9d896

    Score
    10/10
    echelondiscoveryspywarestealer

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Echelon log file

      Detects a log file produced by Echelon.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks