Behavioral task
behavioral1
Sample
b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6.exe
Resource
win10v2004-20231215-en
General
-
Target
b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6
-
Size
585KB
-
MD5
d25d1dcee63d3bbfdc49aba027523a0e
-
SHA1
e548db4e62cb4fd8a7a60ff45c9ed3d1eb67765a
-
SHA256
b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6
-
SHA512
6bedb1a8a874982b3411f4cca18ae5dc1655b3c690e25a271249f055623c4e7ad94682c29fb61fcc4da4eabf04c91a3e09f54ac5c2288c292ba23f584446c00d
-
SSDEEP
12288:JxUODVR9ZLJLUf9snBS4csPYae6qfzbAA:JiODVR9hhUF54clNf7bB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6
Files
-
b81af7454823adcacd6be76456d33618654ab670ede042e3a74ba4435ce58ef6.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 583KB - Virtual size: 582KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ