General
-
Target
a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2
-
Size
1.8MB
-
Sample
220309-q8wtyabgbj
-
MD5
07f3f1699ca50451845d7704456f85bd
-
SHA1
e6f4fb512f3dfe5f53181d9b38f12b75b454dba7
-
SHA256
a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2
-
SHA512
547feed44c7529de9f22967ee2942a0bcec03faaa75853cb336d7fc8564fd1d77fc7800dcf5a508546819413aca58c8b826857ae02835b9a432d655adbff31e2
Malware Config
Targets
-
-
Target
a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2
-
Size
1.8MB
-
MD5
07f3f1699ca50451845d7704456f85bd
-
SHA1
e6f4fb512f3dfe5f53181d9b38f12b75b454dba7
-
SHA256
a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2
-
SHA512
547feed44c7529de9f22967ee2942a0bcec03faaa75853cb336d7fc8564fd1d77fc7800dcf5a508546819413aca58c8b826857ae02835b9a432d655adbff31e2
Score10/10-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file
Detects a log file produced by Echelon.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-