General

  • Target

    d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

  • Size

    581KB

  • Sample

    240520-bglsbscd92

  • MD5

    3887c0b99e35e5571dfbb9666ba95755

  • SHA1

    a2614a09c832ed1a4ef8ffa754d22b4e3e991c5b

  • SHA256

    d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

  • SHA512

    7c6d5a6694c610c6dcaacca1bd61354958ebdcef4861d758ad496c938774fba1af3c64c3609e48ced83654fc26dfc3c30571114521b132f5cc932c0d41fd652a

  • SSDEEP

    12288:uy5Hukd8lEWd+f6BrWZLJLUf9snBS4csPYae6qfzIAA:95MrWhhUF54clNf7IB

Malware Config

Targets

    • Target

      d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

    • Size

      581KB

    • MD5

      3887c0b99e35e5571dfbb9666ba95755

    • SHA1

      a2614a09c832ed1a4ef8ffa754d22b4e3e991c5b

    • SHA256

      d4e6982fce9dbcd7cb34916a10e1e49c6fdfbef85b2773eb0516ae89b1bf877f

    • SHA512

      7c6d5a6694c610c6dcaacca1bd61354958ebdcef4861d758ad496c938774fba1af3c64c3609e48ced83654fc26dfc3c30571114521b132f5cc932c0d41fd652a

    • SSDEEP

      12288:uy5Hukd8lEWd+f6BrWZLJLUf9snBS4csPYae6qfzIAA:95MrWhhUF54clNf7IB

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

MITRE ATT&CK Enterprise v15

Tasks