Overview

overview

10

Static

static

10

d4e6982fce...7f.exe

windows7-x64

10

d4e6982fce...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

  • Size

    581KB

  • Sample

    240520-bglsbscd92

  • MD5

    3887c0b99e35e5571dfbb9666ba95755

  • SHA1

    a2614a09c832ed1a4ef8ffa754d22b4e3e991c5b

  • SHA256

    d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

  • SHA512

    7c6d5a6694c610c6dcaacca1bd61354958ebdcef4861d758ad496c938774fba1af3c64c3609e48ced83654fc26dfc3c30571114521b132f5cc932c0d41fd652a

  • SSDEEP

    12288:uy5Hukd8lEWd+f6BrWZLJLUf9snBS4csPYae6qfzIAA:95MrWhhUF54clNf7IB

Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

    • Size

      581KB

    • MD5

      3887c0b99e35e5571dfbb9666ba95755

    • SHA1

      a2614a09c832ed1a4ef8ffa754d22b4e3e991c5b

    • SHA256

      d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

    • SHA512

      7c6d5a6694c610c6dcaacca1bd61354958ebdcef4861d758ad496c938774fba1af3c64c3609e48ced83654fc26dfc3c30571114521b132f5cc932c0d41fd652a

    • SSDEEP

      12288:uy5Hukd8lEWd+f6BrWZLJLUf9snBS4csPYae6qfzIAA:95MrWhhUF54clNf7IB

    Score
    10/10
    echelonspywarestealercollectiondiscovery

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks