General
-
Target
ce8ae5acdeccfbc302bf99ddc799bfc747119dce76f0dc589df4232b6247842b
-
Size
1.7MB
-
Sample
220309-b33b7seghj
-
MD5
b0338e58388c9040a0f88d0f44ef3714
-
SHA1
7e664c348735efed508666fec173bb17fa8025f8
-
SHA256
ce8ae5acdeccfbc302bf99ddc799bfc747119dce76f0dc589df4232b6247842b
-
SHA512
b5d52004d648da1ea0973186281b0cf34a8bee04f10bcce14e6ebc231ff768d0dc37fe2b3e231cb6dfd8b8f9cf6f2af0fb2ec65d860473a2cbd2a5672aedd899
Malware Config
Targets
-
-
Target
ce8ae5acdeccfbc302bf99ddc799bfc747119dce76f0dc589df4232b6247842b
-
Size
1.7MB
-
MD5
b0338e58388c9040a0f88d0f44ef3714
-
SHA1
7e664c348735efed508666fec173bb17fa8025f8
-
SHA256
ce8ae5acdeccfbc302bf99ddc799bfc747119dce76f0dc589df4232b6247842b
-
SHA512
b5d52004d648da1ea0973186281b0cf34a8bee04f10bcce14e6ebc231ff768d0dc37fe2b3e231cb6dfd8b8f9cf6f2af0fb2ec65d860473a2cbd2a5672aedd899
Score10/10-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file
Detects a log file produced by Echelon.
-
Executes dropped EXE
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-