echelon

General

Target

f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
Size

1.4MB
Sample

240318-bptg5sch49
MD5

2c79e627d6cbe94d0f577a6f828ca839
SHA1

fc8b24ea84099560d82b96e784a00294568e3740
SHA256

f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
SHA512

e5751126ce586830931b53cc1963074041aef7b2ad3f3bc627d6b2c61b6b249fe7969b657c74dc97cd758760ab8092714188fc8422c6ddfa16e38c37a320075b
SSDEEP

24576:7970JbUadeO+P9AYU4IIH3JyN4yCHMSXZVM3CM5cPVbVOsIogCjh9A+NIdWs:BIJYad8AzU3Jy/CHJpm3CM5ctVO5ogOY

Score

10^/10

Malware Config

Targets

- Target
  
  f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
- Size
  
  1.4MB
- MD5
  
  2c79e627d6cbe94d0f577a6f828ca839
- SHA1
  
  fc8b24ea84099560d82b96e784a00294568e3740
- SHA256
  
  f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
- SHA512
  
  e5751126ce586830931b53cc1963074041aef7b2ad3f3bc627d6b2c61b6b249fe7969b657c74dc97cd758760ab8092714188fc8422c6ddfa16e38c37a320075b
- SSDEEP
  
  24576:7970JbUadeO+P9AYU4IIH3JyN4yCHMSXZVM3CM5cPVbVOsIogCjh9A+NIdWs:BIJYad8AzU3Jy/CHJpm3CM5ctVO5ogOY
Score

10^/10

echelon spyware stealer collection discovery
- Detects Echelon Stealer payload
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Detects executables referencing Windows vault credential objects. Observed in infostealers
- Detects executables referencing many VPN software clients. Observed in infosteslers
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
- Detects executables referencing many email and collaboration clients. Observed in information stealers
- Detects executables using Telegram Chat Bot
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2