Behavioral task
behavioral1
Sample
db44079e2ca46cdf65a5d0e187b734b86cd3ff6e44b272e4e5b387d85a2548f9.exe
Resource
win7-20231215-en
General
-
Target
db44079e2ca46cdf65a5d0e187b734b86cd3ff6e44b272e4e5b387d85a2548f9
-
Size
656KB
-
MD5
1da5056fb164f0bdb60933a8818c1c66
-
SHA1
8d608239dfd2b0a7bcd469c31e7b73799cb13545
-
SHA256
db44079e2ca46cdf65a5d0e187b734b86cd3ff6e44b272e4e5b387d85a2548f9
-
SHA512
81633e068df3923679b9dcc4881f6678a0417c3aa756b1d7bfa9c7dea6e22857a6a9d010f6853d5816699b36cbcb5c7340957b2ae529ee169fe0ac64d6dd9adf
-
SSDEEP
6144:5jsXkjonQ48gSQ/suCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsTDDpBnseF:9s0cnpCQL32ikCaUS4csRBse6sfWWAA
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db44079e2ca46cdf65a5d0e187b734b86cd3ff6e44b272e4e5b387d85a2548f9
Files
-
db44079e2ca46cdf65a5d0e187b734b86cd3ff6e44b272e4e5b387d85a2548f9.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 653KB - Virtual size: 653KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ