General

  • Target

    5725_1647679559_4598.exe

  • Size

    581KB

  • Sample

    220325-h8z8csgdgj

  • MD5

    f3048cd63908b421adb1d1b4b1fba98f

  • SHA1

    0f9f56a7d500aa86ddc6c2c9a92843768590eee5

  • SHA256

    d5a7c67747c1d8095b6fb6fef9f446b048a753bfda98e9cf19f265a6203e27cf

  • SHA512

    e1fe58834c95ef71c142aab568b551acb82560c8cf53bb5e757be57f9dd6412e1fc0f817bc463cdc6dbbe172bff2d1f4e84d2ba072a599eca21822c4593aac45

Malware Config

Targets

    • Target

      5725_1647679559_4598.exe

    • Size

      581KB

    • MD5

      f3048cd63908b421adb1d1b4b1fba98f

    • SHA1

      0f9f56a7d500aa86ddc6c2c9a92843768590eee5

    • SHA256

      d5a7c67747c1d8095b6fb6fef9f446b048a753bfda98e9cf19f265a6203e27cf

    • SHA512

      e1fe58834c95ef71c142aab568b551acb82560c8cf53bb5e757be57f9dd6412e1fc0f817bc463cdc6dbbe172bff2d1f4e84d2ba072a599eca21822c4593aac45

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks