echelon | 07e3cf6d608401dd2b8cc367deea6c4d9ea110056d3f32bfd87e1f8555083cf1 | Triage

Sharing

General

Target

87eaf345538203eec98ef5eb3f5fb4e2
Size

1.0MB
Sample

240201-27p6jsaegm
MD5

87eaf345538203eec98ef5eb3f5fb4e2
SHA1

3c32b64679c2e85b9b843ed7a3a38094b5719ba4
SHA256

07e3cf6d608401dd2b8cc367deea6c4d9ea110056d3f32bfd87e1f8555083cf1
SHA512

553ce491a393f32ba67a8c1871fddc840bd3fc2569f57af5ae20a9ee40961e7c435cf91cdfe93574777932d08abd5380b6dfdb607aee080542cb40f157419c9d
SSDEEP

24576:0fQYNBhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoR12Q:Uo54clgLH+tkWJ0N5

Score

10^/10

echelon spyware stealer

Malware Config

Targets

- Target
  
  87eaf345538203eec98ef5eb3f5fb4e2
- Size
  
  1.0MB
- MD5
  
  87eaf345538203eec98ef5eb3f5fb4e2
- SHA1
  
  3c32b64679c2e85b9b843ed7a3a38094b5719ba4
- SHA256
  
  07e3cf6d608401dd2b8cc367deea6c4d9ea110056d3f32bfd87e1f8555083cf1
- SHA512
  
  553ce491a393f32ba67a8c1871fddc840bd3fc2569f57af5ae20a9ee40961e7c435cf91cdfe93574777932d08abd5380b6dfdb607aee080542cb40f157419c9d
- SSDEEP
  
  24576:0fQYNBhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoR12Q:Uo54clgLH+tkWJ0N5
Score

10^/10

echelon spyware stealer
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

echelonspywarestealer