echelon

General

Target

be7fb27a2d8fe2dcb1573590373ccab7.bin
Size

335KB
Sample

230226-b1xnyafb3y
MD5

6f11f72c761d8f78e03ecd3f507c96af
SHA1

5e04c3b7d1f66ee0305f198df096efd4241acae7
SHA256

88188cbc0bf1cba70761ebabc82092358d49dfb67eea107541e1340dd03a2d9e
SHA512

982173bfa85296752484837093dce985e7d1ec8eb2e49663a1d9e151020eb1edb35ab22f413eb5baa6b94e6307a9ab408bca88ad71a9d209052fdf5e994c9d25
SSDEEP

6144:IIKVJobwyJ7keq5tnD/wUpd/i4MCr+X4cY0/3t1A3caKndtb28sSR2:n57Zq5FD9Vi4PKnD/3tK3NKdtn7R2

Score

10^/10

Malware Config

Targets

- Target
  
  be7fb27a2d8fe2dcb1573590373ccab7.bin
- Size
  
  335KB
- MD5
  
  6f11f72c761d8f78e03ecd3f507c96af
- SHA1
  
  5e04c3b7d1f66ee0305f198df096efd4241acae7
- SHA256
  
  88188cbc0bf1cba70761ebabc82092358d49dfb67eea107541e1340dd03a2d9e
- SHA512
  
  982173bfa85296752484837093dce985e7d1ec8eb2e49663a1d9e151020eb1edb35ab22f413eb5baa6b94e6307a9ab408bca88ad71a9d209052fdf5e994c9d25
- SSDEEP
  
  6144:IIKVJobwyJ7keq5tnD/wUpd/i4MCr+X4cY0/3t1A3caKndtb28sSR2:n57Zq5FD9Vi4PKnD/3tK3NKdtn7R2
Score

1^/10
behavioral1 behavioral2
- Target
  
  37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320.exe
- Size
  
  582KB
- MD5
  
  be7fb27a2d8fe2dcb1573590373ccab7
- SHA1
  
  1f97541db03a96f28c786e99ee40d8da1a2035fd
- SHA256
  
  37b659aa22473d3c2c8d94a2f83735a3e849fa148955401751e9a28963171320
- SHA512
  
  209d24bb976d671755bf3cdfffdc9d28d2f7c2fd372d3dd6e1a2fdcb537a50ddfd296a661b3627652d945317b0c211d46b569235897a010bac77aea97de28605
- SSDEEP
  
  12288:Ha4ne0dXFMetm3aC33ZLJLUf9snBS4csPYae6qfzFAA:T5I33hhUF54clNf7FB
Score

10^/10

echelon collection discovery spyware stealer
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4