Behavioral task
behavioral1
Sample
209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d.exe
Resource
win10v2004-20231127-en
General
-
Target
209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d
-
Size
581KB
-
MD5
0d57bc0de960b029031218b0f5e25793
-
SHA1
ff725d9ed70c1a0bcfd0dbd7b28292618f824d1f
-
SHA256
209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d
-
SHA512
01ed70ba53b3b456ff7d75f7613009ccf0c107c3f547fa44dcb642efeedec17c5f825f1d4c5ce02e43be09d62dfb3b0042581fc005c3d210f75ad232fd4249cc
-
SSDEEP
12288:kG5mTsV0OQCtMjpwsrJZLJLUf9snBS4csPYae6qfzsAA:y8hsrJhhUF54clNf7sB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d
Files
-
209cd06f61686aaded4e58926695654243a50c486a66d29b7afb7e947c85b81d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 578KB - Virtual size: 578KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ