Behavioral task
behavioral1
Sample
56b9cbe1556dd419bec522a473a70a20.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
56b9cbe1556dd419bec522a473a70a20.exe
Resource
win10v2004-20231215-en
General
-
Target
56b9cbe1556dd419bec522a473a70a20
-
Size
674KB
-
MD5
56b9cbe1556dd419bec522a473a70a20
-
SHA1
6077796a394c2235f87d02dfd14096ee3cc2fe78
-
SHA256
e74ba4cb7a8950928fb8bc8f3089ca49c295dd4197afb89ddcee666685da6c0a
-
SHA512
eccfb376ab6bbbe79e24b21fdd1c6c682675db04bb7b5574853eca30d79d9ee571a70ac3f7c29c933c2cbf906faca4c7cbbedd62e83194351f856bacf03bb57e
-
SSDEEP
12288:ILfpljJgZSsAjAuYcVWfs6MDMVqfBdcmDBuvXEVd:0JwcAuv0fKMVqJdczEVd
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 56b9cbe1556dd419bec522a473a70a20
Files
-
56b9cbe1556dd419bec522a473a70a20.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 540KB - Virtual size: 540KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ