Overview

overview

10

Static

static

10

13ef7e3685...13.exe

windows7-x64

10

13ef7e3685...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    13ef7e3685c4a648b92825ff7bde600e7c2efa2aff0699c8f4cbd06b5225f313

  • Size

    1.8MB

  • Sample

    240305-b88q6sbg63

  • MD5

    033c1ee70bcc0d569f4a8077f0cbfe38

  • SHA1

    34e498158fa012052d4785a8de59159b6a0e4649

  • SHA256

    13ef7e3685c4a648b92825ff7bde600e7c2efa2aff0699c8f4cbd06b5225f313

  • SHA512

    36fe82804eaf16f9e669abb895b0a2687db98c42da78f805ab053e518c17211a3a4f305c4f8ec296525f2cbd4e76b028a1aed7a4b304e128439a3343228948b2

  • SSDEEP

    24576:v2G/nvxW3WwXdptGjLB46VvbuhZUTd8hhUF54clNf7+6uHAW92zt/sWu2BSMCqD7:vbA3Zz+bKo54clgLH+tkWJ0N8X

Score
10/10
echelonspywarestealer

Malware Config

Targets

    • Target

      13ef7e3685c4a648b92825ff7bde600e7c2efa2aff0699c8f4cbd06b5225f313

    • Size

      1.8MB

    • MD5

      033c1ee70bcc0d569f4a8077f0cbfe38

    • SHA1

      34e498158fa012052d4785a8de59159b6a0e4649

    • SHA256

      13ef7e3685c4a648b92825ff7bde600e7c2efa2aff0699c8f4cbd06b5225f313

    • SHA512

      36fe82804eaf16f9e669abb895b0a2687db98c42da78f805ab053e518c17211a3a4f305c4f8ec296525f2cbd4e76b028a1aed7a4b304e128439a3343228948b2

    • SSDEEP

      24576:v2G/nvxW3WwXdptGjLB46VvbuhZUTd8hhUF54clNf7+6uHAW92zt/sWu2BSMCqD7:vbA3Zz+bKo54clgLH+tkWJ0N8X

    Score
    10/10
    echelonspywarestealer

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks