echelon | 3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74 | Triage

Submit
Reports

Overview

overview

Static

static

3bc1d00f06...74.exe

windows7-x64

3bc1d00f06...74.exe

windows10-2004-x64

Sharing

General

Target

3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74
Size

1.5MB
Sample

240330-bq72xsef49
MD5

b48e703173ef1528c021f5378342fed3
SHA1

86c4f91ced9e9090ef17e0a2c1c1f494ddd61e93
SHA256

3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74
SHA512

ab6932abcc92ae8b9404fe54e421c28f59820eba63054ea10ab81c49db739f79a82237f77dfe8527727ba2e30fa12af8bcfc99f23891a3988a73386d46361075
SSDEEP

24576:PFOa+nsJ39LyjbJkQFMhmC+6GD9iS0NYTuothhUF54clNf7zBl:tSnsHyjtk2MYC5GDgIo54cl9z

Score

10^/10

echelon evasion persistence spyware stealer

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe

Resource

win7-20240221-en

echelon evasion persistence spyware stealer

windows7-x64

22 signatures

150 seconds

Behavioral task

behavioral2

Sample

3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe

Resource

win10v2004-20240319-en

echelon evasion persistence spyware stealer

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74
- Size
  
  1.5MB
- MD5
  
  b48e703173ef1528c021f5378342fed3
- SHA1
  
  86c4f91ced9e9090ef17e0a2c1c1f494ddd61e93
- SHA256
  
  3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74
- SHA512
  
  ab6932abcc92ae8b9404fe54e421c28f59820eba63054ea10ab81c49db739f79a82237f77dfe8527727ba2e30fa12af8bcfc99f23891a3988a73386d46361075
- SSDEEP
  
  24576:PFOa+nsJ39LyjbJkQFMhmC+6GD9iS0NYTuothhUF54clNf7zBl:tSnsHyjtk2MYC5GDgIo54cl9z
Score

10^/10

echelon evasion persistence spyware stealer
- Detects Echelon Stealer payload
- Echelon
  Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
  stealer spyware echelon
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

echelonevasionpersistencespywarestealer

behavioral2

echelonevasionpersistencespywarestealer

© 2018-2024

Terms | Privacy