echelon | 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

Sharing

Copy URL Twitter E-mail

General

Target
0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d
Size 2.3MB
Sample240304-bmvbnaef59
SHA256 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d
MD5 07aa0a33eb921a940635dd804be277af
SHA1 16e53f37a15dc860d3e2a0a12270785d78569cf7
SHA512 4e0185c618e99d1e2e095ff63b1ca9999a0e91bfd87d2e120e8fcf0c83e3ff113e73f13d9e5a2f17f06f672bcf2e25eef5df5db352aac11eed3b6bf00db177a2
SSDEEP 49152:8CN4LRX+yXXpJX0gRgSSlhSGmpcmueezjO:8CN49X+yHpyuUSpvuPjO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

echelon

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

resource	yara_rule
sample	family_echelon

Echelon family
echelon

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

File Explorer

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

.exe 2.3MB

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d
MD5 07aa0a33eb921a940635dd804be277af
SHA1 16e53f37a15dc860d3e2a0a12270785d78569cf7
SHA512 4e0185c618e99d1e2e095ff63b1ca9999a0e91bfd87d2e120e8fcf0c83e3ff113e73f13d9e5a2f17f06f672bcf2e25eef5df5db352aac11eed3b6bf00db177a2
SSDEEP 49152:8CN4LRX+yXXpJX0gRgSSlhSGmpcmueezjO:8CN49X+yHpyuUSpvuPjO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects Echelon Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2482186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

iJY,3Oc`

Size

908KB

Virtual Size

908KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

iJY,3Oc`

Size

908KB

Virtual Size

908KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

561KB

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

yxCCMULz

Size

512B

Virtual Size

22B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.????

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Q54bb5b8

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

mscoree

dotnet