Overview

overview

10

Static

static

1

aace25e181...in.exe

windows7-x64

10

aace25e181...in.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aace25e181c08dbc3348e22f8864b82d.bin.exe

  • Size

    1.6MB

  • Sample

    230314-sdvz9sgb37

  • MD5

    aace25e181c08dbc3348e22f8864b82d

  • SHA1

    6c389364ebbc56bd7ec38a9b9b35dfd6347844e2

  • SHA256

    12fddd87e81d0e3b6f62f79af43a483528ae278c0f555ced9ab27d6ba9441125

  • SHA512

    2ce883b342d26564b011bc5a365317a76201e7bd8977498d5d88f4343e5715f7a72540b9f7fd0c6c820285e906afa0f48662316d1c00ae9c30cd6f7f72b9c534

  • SSDEEP

    12288:mKWa6AbsDI0slfH/1G02NVjA7HcHQCrZYyyvSoDPs0rYGnjMevnb880ymljs:fPs4diQcwCruyyjsKIonHToj

Score
10/10
echeloncollectionspywarestealer

Malware Config

Targets

    • Target

      aace25e181c08dbc3348e22f8864b82d.bin.exe

    • Size

      1.6MB

    • MD5

      aace25e181c08dbc3348e22f8864b82d

    • SHA1

      6c389364ebbc56bd7ec38a9b9b35dfd6347844e2

    • SHA256

      12fddd87e81d0e3b6f62f79af43a483528ae278c0f555ced9ab27d6ba9441125

    • SHA512

      2ce883b342d26564b011bc5a365317a76201e7bd8977498d5d88f4343e5715f7a72540b9f7fd0c6c820285e906afa0f48662316d1c00ae9c30cd6f7f72b9c534

    • SSDEEP

      12288:mKWa6AbsDI0slfH/1G02NVjA7HcHQCrZYyyvSoDPs0rYGnjMevnb880ymljs:fPs4diQcwCruyyjsKIonHToj

    Score
    10/10
    echelonspywarestealercollection

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks