General
-
Target
ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
-
Size
1018KB
-
Sample
220520-3vlg9scdfq
-
MD5
6ac52086b2353d329f2c6b96dfc4b2bd
-
SHA1
c9ab0a3a4c3439d15ad30a6ea0ad738296853b24
-
SHA256
ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
-
SHA512
c86f4ce9c915419fe4f43af577ac930413665e4ae9df7453047abe445a08f3910a2e7929d580ba57ecf694302e4f08949ca24278e5f463cc947f32036979f6ff
Malware Config
Targets
-
-
Target
ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
-
Size
1018KB
-
MD5
6ac52086b2353d329f2c6b96dfc4b2bd
-
SHA1
c9ab0a3a4c3439d15ad30a6ea0ad738296853b24
-
SHA256
ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
-
SHA512
c86f4ce9c915419fe4f43af577ac930413665e4ae9df7453047abe445a08f3910a2e7929d580ba57ecf694302e4f08949ca24278e5f463cc947f32036979f6ff
Score10/10-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Executes dropped EXE
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-