Overview

overview

10

Static

static

11d284da38...20.exe

windows7-x64

10

11d284da38...20.exe

windows10-2004-x64

10

Resubmissions

24-11-2022 20:56

221124-zq55bshe78 10

24-11-2022 20:52

221124-zn5qsace3t 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11d284da38a3e8a66b68d6d80dcb6d307f8c8fc263ef460e7860fdad4fc76f20

  • Size

    2.3MB

  • Sample

    221124-zq55bshe78

  • MD5

    060eb923702159f7e6c52e7cc1ccb806

  • SHA1

    01dd985cc05a78a34708168a0a3c679b26992177

  • SHA256

    11d284da38a3e8a66b68d6d80dcb6d307f8c8fc263ef460e7860fdad4fc76f20

  • SHA512

    306f8adea85d0dbe3df9b76c620fbd70dd4e1ba7ec8cacad4c2564f89be8e893c09e995304fca54da43c60da8697106463607d674b3f1d32d2dec1922b7f52f1

  • SSDEEP

    49152:PHlfU0WtYPWn0mWZhjzXbJKMXKL1i9kjpPSaodI8WHVakO4mVSb+KuGLU:PN5ktELIBlPSpWROv/Ke

Score
10/10
echelonspywarestealer

Malware Config

Targets

    • Target

      11d284da38a3e8a66b68d6d80dcb6d307f8c8fc263ef460e7860fdad4fc76f20

    • Size

      2.3MB

    • MD5

      060eb923702159f7e6c52e7cc1ccb806

    • SHA1

      01dd985cc05a78a34708168a0a3c679b26992177

    • SHA256

      11d284da38a3e8a66b68d6d80dcb6d307f8c8fc263ef460e7860fdad4fc76f20

    • SHA512

      306f8adea85d0dbe3df9b76c620fbd70dd4e1ba7ec8cacad4c2564f89be8e893c09e995304fca54da43c60da8697106463607d674b3f1d32d2dec1922b7f52f1

    • SSDEEP

      49152:PHlfU0WtYPWn0mWZhjzXbJKMXKL1i9kjpPSaodI8WHVakO4mVSb+KuGLU:PN5ktELIBlPSpWROv/Ke

    Score
    10/10
    echelonspywarestealer

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks