echelon | d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549 | Triage

Submit
Reports

Overview

overview

Static

static

d1b01198e7...49.exe

windows7-x64

d1b01198e7...49.exe

windows10-2004-x64

Sharing

General

Target

d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549
Size

653KB
Sample

240122-bk68fadcbm
MD5

4d5105d2259c6392e806eb17794a31cd
SHA1

ec92cb1cefcf9a3e92dbbf68c7566f3435942dd1
SHA256

d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549
SHA512

49aa185eb5331e1d6449d23cfffa8875c1964ee8f6e136fdc07a4ffa204a2d9458ae30d7567b8cb8504ebf19072411f33163f5a6efdb0ba12741c2ab3ac8b2ed
SSDEEP

6144:CmDm/12Uqs/nh7IyMSogUNKSuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsY:LD4wyxQQL32ikCaUS4csRBse6sfWdAA

Score

10^/10

echelon spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549.exe

Resource

win7-20231215-en

echelon spyware stealer

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549.exe

Resource

win10v2004-20231215-en

echelon spyware stealer

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  
  d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549
- Size
  
  653KB
- MD5
  
  4d5105d2259c6392e806eb17794a31cd
- SHA1
  
  ec92cb1cefcf9a3e92dbbf68c7566f3435942dd1
- SHA256
  
  d1b01198e7d83256c27540b075ce9de4e18cac1c73e83001d9e7398e8fbb2549
- SHA512
  
  49aa185eb5331e1d6449d23cfffa8875c1964ee8f6e136fdc07a4ffa204a2d9458ae30d7567b8cb8504ebf19072411f33163f5a6efdb0ba12741c2ab3ac8b2ed
- SSDEEP
  
  6144:CmDm/12Uqs/nh7IyMSogUNKSuCInHLhJI4FY/ixjci6ychf8xalGQGtSV41kJDsY:LD4wyxQQL32ikCaUS4csRBse6sfWdAA
Score

10^/10

echelon spyware stealer
- Detects Echelon Stealer payload
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

echelonspywarestealer

behavioral2

echelonspywarestealer

© 2018-2024

Terms | Privacy