Overview

overview

10

Static

static

pass.exe

windows7_x64

10

pass.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pass.exe

  • Size

    863KB

  • Sample

    210730-t683lmbs4a

  • MD5

    a27ba5e68cdd7333b8cd5e4ebd558019

  • SHA1

    c4e6d99f3979003424ad4cc511a36434944c02b0

  • SHA256

    e42ba94ba2b856fdb7aa01b9dee11abd71c55b6fc15e1933a77269deedb57e88

  • SHA512

    2edfb1bae88e3088da81fbcf382fa7955998562817eb9f25bfaef6d82cbeb064c93764d1f9f127ad667543854109da6df84938cbb8d9b62eabf3a00ee5699ff1

Score
10/10
echelonspywarestealersuricata

Malware Config

Targets

    • Target

      pass.exe

    • Size

      863KB

    • MD5

      a27ba5e68cdd7333b8cd5e4ebd558019

    • SHA1

      c4e6d99f3979003424ad4cc511a36434944c02b0

    • SHA256

      e42ba94ba2b856fdb7aa01b9dee11abd71c55b6fc15e1933a77269deedb57e88

    • SHA512

      2edfb1bae88e3088da81fbcf382fa7955998562817eb9f25bfaef6d82cbeb064c93764d1f9f127ad667543854109da6df84938cbb8d9b62eabf3a00ee5699ff1

    Score
    10/10
    echelonspywarestealersuricata

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

      suricata

    • suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

      suricata

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks