General

  • Target

    cd4a896224f9dcda6f0244bae4ef9abf

  • Size

    581KB

  • MD5

    cd4a896224f9dcda6f0244bae4ef9abf

  • SHA1

    d362ab6e88e94c7a4200206f5d74c68eabc9dd07

  • SHA256

    b7291b4d5bdaaffe9f29598bcf3dd822cee39b18d485d2071ee2ae41b9ccdfb2

  • SHA512

    438f7ccb8b347c4928e1727b0800351b79308ee912272f85e0ec0c49c860216d102a06dd961044117f253cada879773bc9b76fdbf5b975a6af2238559d3a7f0d

  • SSDEEP

    12288:wcQ6CmvZLJLUf9snBS4csPYae6qfzRAA:k6xvhhUF54clNf7RB

Score
10/10

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
  • Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Echelon family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • cd4a896224f9dcda6f0244bae4ef9abf
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections