General
-
Target
3316277e7a7f52c5947328ac52fad225295b8c17ddc71bcd0d03cdac6d292894
-
Size
16.2MB
-
Sample
220327-2r96sadhe4
-
MD5
7bfb2c60019c6b03c7853718d3c24f67
-
SHA1
390dad7ffe4dbd389f52e6589c98ab77998b7014
-
SHA256
3316277e7a7f52c5947328ac52fad225295b8c17ddc71bcd0d03cdac6d292894
-
SHA512
3ea3fbc7184ba03d6bce3eaa9620c2f8962d8a5494c87bde3d3291b9e4d73fab9861a0ef165e40e17b366a6425ce107dbe9e679b63182b633c8b69c1d69bc8cb
Malware Config
Targets
-
-
Target
3316277e7a7f52c5947328ac52fad225295b8c17ddc71bcd0d03cdac6d292894
-
Size
16.2MB
-
MD5
7bfb2c60019c6b03c7853718d3c24f67
-
SHA1
390dad7ffe4dbd389f52e6589c98ab77998b7014
-
SHA256
3316277e7a7f52c5947328ac52fad225295b8c17ddc71bcd0d03cdac6d292894
-
SHA512
3ea3fbc7184ba03d6bce3eaa9620c2f8962d8a5494c87bde3d3291b9e4d73fab9861a0ef165e40e17b366a6425ce107dbe9e679b63182b633c8b69c1d69bc8cb
Score10/10-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file
Detects a log file produced by Echelon.
-
Executes dropped EXE
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-