General
-
Target
f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
-
Size
1.4MB
-
Sample
240318-bptg5sch49
-
MD5
2c79e627d6cbe94d0f577a6f828ca839
-
SHA1
fc8b24ea84099560d82b96e784a00294568e3740
-
SHA256
f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
-
SHA512
e5751126ce586830931b53cc1963074041aef7b2ad3f3bc627d6b2c61b6b249fe7969b657c74dc97cd758760ab8092714188fc8422c6ddfa16e38c37a320075b
-
SSDEEP
24576:7970JbUadeO+P9AYU4IIH3JyN4yCHMSXZVM3CM5cPVbVOsIogCjh9A+NIdWs:BIJYad8AzU3Jy/CHJpm3CM5ctVO5ogOY
Malware Config
Targets
-
-
Target
f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
-
Size
1.4MB
-
MD5
2c79e627d6cbe94d0f577a6f828ca839
-
SHA1
fc8b24ea84099560d82b96e784a00294568e3740
-
SHA256
f78995fd865b6f50c2cdb18c589216238b539b2fa635b89061b1ab4644053f6c
-
SHA512
e5751126ce586830931b53cc1963074041aef7b2ad3f3bc627d6b2c61b6b249fe7969b657c74dc97cd758760ab8092714188fc8422c6ddfa16e38c37a320075b
-
SSDEEP
24576:7970JbUadeO+P9AYU4IIH3JyN4yCHMSXZVM3CM5cPVbVOsIogCjh9A+NIdWs:BIJYad8AzU3Jy/CHJpm3CM5ctVO5ogOY
Score10/10-
Detects Echelon Stealer payload
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Detects executables referencing Windows vault credential objects. Observed in infostealers
-
Detects executables referencing many VPN software clients. Observed in infosteslers
-
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers
-
Detects executables referencing many email and collaboration clients. Observed in information stealers
-
Detects executables using Telegram Chat Bot
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-