Overview

overview

10

Static

static

c481259ad1...37.exe

windows7_x64

7

c481259ad1...37.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c481259ad199b773339f168902cc7437.exe

  • Size

    267KB

  • Sample

    210317-hv4pd7mepx

  • MD5

    c481259ad199b773339f168902cc7437

  • SHA1

    4c9a81f2a9167f953109eddbd141ea8d078d13e9

  • SHA256

    1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da

  • SHA512

    5bc8965e9aa550f3e37b312f3d4a6854b0002f42b5a111087a754e3ed7cdcf957b40f6bebc389b405317b46eeaed88132545732daac74723945591ae38cdcabf

Score
10/10
echelonspywarestealer

Malware Config

Targets

    • Target

      c481259ad199b773339f168902cc7437.exe

    • Size

      267KB

    • MD5

      c481259ad199b773339f168902cc7437

    • SHA1

      4c9a81f2a9167f953109eddbd141ea8d078d13e9

    • SHA256

      1da5a6aac7197d1fcadef018775831885b715d5c37a3115777dc5c717ce6e0da

    • SHA512

      5bc8965e9aa550f3e37b312f3d4a6854b0002f42b5a111087a754e3ed7cdcf957b40f6bebc389b405317b46eeaed88132545732daac74723945591ae38cdcabf

    Score
    10/10
    spywarestealerechelon

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks