echelon

General

Target

de5d863d87d27d57f0451daa27013fe3d47897164edb01a1b87f7989d79579f8
Size

14.7MB
Sample

220525-bhxwzshehm
MD5

e63a098562fac6ff7fe26598d858c735
SHA1

1c3f06ad01d9c0620d30b79068493a2a2b28c286
SHA256

de5d863d87d27d57f0451daa27013fe3d47897164edb01a1b87f7989d79579f8
SHA512

b73ade1277dcc551a6365ac66a7c079e1b70eb7c167b8c92a086dbd55d7441ad05f91b0bf2cccc7d08cce5bc981ca3dceb0afebb0f616ea7f822b4edc5df79ee

Score

10^/10

Malware Config

Targets

- Target
  
  de5d863d87d27d57f0451daa27013fe3d47897164edb01a1b87f7989d79579f8
- Size
  
  14.7MB
- MD5
  
  e63a098562fac6ff7fe26598d858c735
- SHA1
  
  1c3f06ad01d9c0620d30b79068493a2a2b28c286
- SHA256
  
  de5d863d87d27d57f0451daa27013fe3d47897164edb01a1b87f7989d79579f8
- SHA512
  
  b73ade1277dcc551a6365ac66a7c079e1b70eb7c167b8c92a086dbd55d7441ad05f91b0bf2cccc7d08cce5bc981ca3dceb0afebb0f616ea7f822b4edc5df79ee
Score

10^/10

echelon collection discovery spyware stealer suricata
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- suricata: ET MALWARE Win32/MOOZ.THCCABO CoinMiner CnC Checkin
  suricata: ET MALWARE Win32/MOOZ.THCCABO CoinMiner CnC Checkin
  suricata
- Echelon log file
  Detects a log file produced by Echelon.
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext
behavioral1 behavioral2