General

  • Target

    8ecc7c023f4f676b4a69fcd2c52c09a14879cebdcfa50f4dd26d8d5357b22a2a

  • Size

    4.1MB

  • Sample

    220319-ns6yvshad5

  • MD5

    551c11dd00eb8e68c22bc71003630d65

  • SHA1

    92a0ec623eddfb649e9bb77bb079fbd867fa9bdc

  • SHA256

    8ecc7c023f4f676b4a69fcd2c52c09a14879cebdcfa50f4dd26d8d5357b22a2a

  • SHA512

    c1a80698893d1313756de7eef9c7b9badf361917d04d803e3bee8172ce45c3da1595326344d026e3f46578b5806951c006dac4ae12230793dca3fc232dc1f26b

Malware Config

Targets

    • Target

      8ecc7c023f4f676b4a69fcd2c52c09a14879cebdcfa50f4dd26d8d5357b22a2a

    • Size

      4.1MB

    • MD5

      551c11dd00eb8e68c22bc71003630d65

    • SHA1

      92a0ec623eddfb649e9bb77bb079fbd867fa9bdc

    • SHA256

      8ecc7c023f4f676b4a69fcd2c52c09a14879cebdcfa50f4dd26d8d5357b22a2a

    • SHA512

      c1a80698893d1313756de7eef9c7b9badf361917d04d803e3bee8172ce45c3da1595326344d026e3f46578b5806951c006dac4ae12230793dca3fc232dc1f26b

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    • Echelon log file

      Detects a log file produced by Echelon.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks