General
- Target cd4a896224f9dcda6f0244bae4ef9abf
- Size 581KB
- Sample240229-13a1dsed43
- SHA256 b7291b4d5bdaaffe9f29598bcf3dd822cee39b18d485d2071ee2ae41b9ccdfb2
Score
10/10
Malware Config
Targets
-
- Target cd4a896224f9dcda6f0244bae4ef9abf
- Size 581KB
- SHA256 b7291b4d5bdaaffe9f29598bcf3dd822cee39b18d485d2071ee2ae41b9ccdfb2
Score10/10Detects Echelon Stealer payload
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
Detects executables referencing Windows vault credential objects. Observed in infostealers
Detects executables referencing many VPN software clients. Observed in infosteslers
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
Detects executables referencing many email and collaboration clients. Observed in information stealers
Detects executables using Telegram Chat Bot
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.