D:\Users\User\Desktop\ \Echelon-Stealer-v5-master-master\obj\Release\Echelon.pdb
Behavioral task
behavioral1
Sample
6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118
-
Size
1018KB
-
MD5
6ac52086b2353d329f2c6b96dfc4b2bd
-
SHA1
c9ab0a3a4c3439d15ad30a6ea0ad738296853b24
-
SHA256
ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
-
SHA512
c86f4ce9c915419fe4f43af577ac930413665e4ae9df7453047abe445a08f3910a2e7929d580ba57ecf694302e4f08949ca24278e5f463cc947f32036979f6ff
-
SSDEEP
24576:ar4FsOULhhUF54clNf7CokNLQyhFoCRsAz:+o54clMSuNj
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118
Files
-
6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 1015KB - Virtual size: 1014KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ