Behavioral task
behavioral1
Sample
152faee4029f8e6be7863df6591499e0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
152faee4029f8e6be7863df6591499e0.exe
Resource
win10v2004-20231222-en
General
-
Target
152faee4029f8e6be7863df6591499e0.exe
-
Size
586KB
-
MD5
152faee4029f8e6be7863df6591499e0
-
SHA1
b2c485102341297a9851b87fd465f8cecc48e6cc
-
SHA256
e62a5f82689482fa11c20393ff8d07ff6307a99ca1d91ee5536c9f005f9022fe
-
SHA512
c55014ab9d30e0f49abae8aee0e5b8d6fd0d038b2976d354d48c48288166e2e21ff88bf63965a79824061ce02ac30da56cfd58dba2629833c1dfd4283c8154aa
-
SSDEEP
12288:I16h+NBCZLJLUf9snBS4csPYae6qfzMAA:I1TChhUF54clNf7MB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 152faee4029f8e6be7863df6591499e0.exe
Files
-
152faee4029f8e6be7863df6591499e0.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 582KB - Virtual size: 581KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ