Behavioral task
behavioral1
Sample
919b5ef262dea9580ddb6ea3e712f88e2648668db0dc3cd9feb53b046596f5ad.exe
Resource
win7-20231215-en
General
-
Target
919b5ef262dea9580ddb6ea3e712f88e2648668db0dc3cd9feb53b046596f5ad
-
Size
657KB
-
MD5
4cf13cd80b2a4cee383bcb01bf282d14
-
SHA1
41f1cdd2361a651882ab205aedfaf4e710aa0901
-
SHA256
919b5ef262dea9580ddb6ea3e712f88e2648668db0dc3cd9feb53b046596f5ad
-
SHA512
aee296c1d6ef4e4a6c67aa6488c7b2b29636954e36bd4c5de20ee588cab4251f4d11d7aea9e56b5eccbdf99d43bbb06a70a1ae09dad5bb7dc27a1f8c55d12745
-
SSDEEP
12288:qEvA0tdewn+pQL32ikCaUS4csRBse6sfWlAA:qEvAMdjMy3k94cunZelB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 919b5ef262dea9580ddb6ea3e712f88e2648668db0dc3cd9feb53b046596f5ad
Files
-
919b5ef262dea9580ddb6ea3e712f88e2648668db0dc3cd9feb53b046596f5ad.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 654KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ