Overview

overview

10

Static

static

3

01bfa9f983...5c.exe

windows7-x64

10

01bfa9f983...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01bfa9f983bdf585676358024c7e51f30356b72e72b8ddf9af3d3ead16b3f35c

  • Size

    1.6MB

  • Sample

    230921-npa21shf85

  • MD5

    69dd34b00bb9a8b722f860715adaeb92

  • SHA1

    f751650fd9c5a115394f638ab6f02fd6845deff2

  • SHA256

    01bfa9f983bdf585676358024c7e51f30356b72e72b8ddf9af3d3ead16b3f35c

  • SHA512

    f079c7ad594bed5f31dd1f8342442404a2fd4fb977d4d8df9997564e8afe318b66bc6dd6bdb39749a31c20a30d5f91ef169cb5af99500f60f3daed277a9341e8

  • SSDEEP

    24576:Rh7uCEZRy0OhbDfBKYGpLSCKPJwxom9DxKOeGyrM63x6HkKOitJ:X7uCky5KLSbRHaDxveGyrMScHLf

Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      01bfa9f983bdf585676358024c7e51f30356b72e72b8ddf9af3d3ead16b3f35c

    • Size

      1.6MB

    • MD5

      69dd34b00bb9a8b722f860715adaeb92

    • SHA1

      f751650fd9c5a115394f638ab6f02fd6845deff2

    • SHA256

      01bfa9f983bdf585676358024c7e51f30356b72e72b8ddf9af3d3ead16b3f35c

    • SHA512

      f079c7ad594bed5f31dd1f8342442404a2fd4fb977d4d8df9997564e8afe318b66bc6dd6bdb39749a31c20a30d5f91ef169cb5af99500f60f3daed277a9341e8

    • SSDEEP

      24576:Rh7uCEZRy0OhbDfBKYGpLSCKPJwxom9DxKOeGyrM63x6HkKOitJ:X7uCky5KLSbRHaDxveGyrMScHLf

    Score
    10/10
    echeloncollectiondiscoveryspywarestealer

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks