General
-
Target
b4637d8c2f3a8b0813beed94e56d3d62ade0ab6d586772e9e9ea26eb36cab6f8
-
Size
534KB
-
Sample
220508-hasqmahdh9
-
MD5
11f1043d656671413dd38e9d6c181942
-
SHA1
fe8d89533767022425d9dde40b282fd28dd4ec6a
-
SHA256
b4637d8c2f3a8b0813beed94e56d3d62ade0ab6d586772e9e9ea26eb36cab6f8
-
SHA512
fda614e59164b6c528f7e60dc8b34ae95e9454db97c46aa0f53f9e65a6fbe7449710b5a86b3206f493d3e34317735a54c5c13361dbc9fb6c3221c4ced12e4ba5
Malware Config
Targets
-
-
Target
b4637d8c2f3a8b0813beed94e56d3d62ade0ab6d586772e9e9ea26eb36cab6f8
-
Size
534KB
-
MD5
11f1043d656671413dd38e9d6c181942
-
SHA1
fe8d89533767022425d9dde40b282fd28dd4ec6a
-
SHA256
b4637d8c2f3a8b0813beed94e56d3d62ade0ab6d586772e9e9ea26eb36cab6f8
-
SHA512
fda614e59164b6c528f7e60dc8b34ae95e9454db97c46aa0f53f9e65a6fbe7449710b5a86b3206f493d3e34317735a54c5c13361dbc9fb6c3221c4ced12e4ba5
Score10/10-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file
Detects a log file produced by Echelon.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-