C:\Users\kotya\Desktop\Echelon-Stealer-master\obj\Release\Echelon.pdb
Behavioral task
behavioral1
Sample
ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d.exe
Resource
win10v2004-20240508-en
General
-
Target
ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d
-
Size
581KB
-
MD5
a4ae7dbc5cf90bcbe604db392edfdf2c
-
SHA1
8867b2caa03c9387cecb7f8ba28f83408e872a6c
-
SHA256
ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d
-
SHA512
9d59cacec0f9a5a9a477559e969752a94c09a31cc297d87b9db1b892c23d320f49b30e3dc5864821b0c30d5dc2c24a89d32167cf13788af2ffd062b075cd701d
-
SSDEEP
12288:Qy5Hukd8lEWd+f6lYxZLJLUf9snBS4csPYae6qfzSAA:D5AYxhhUF54clNf7SB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d
Files
-
ca5c660e949076575ac6723ccd2cf49c2603fe2a094c2e1c795547a01f0bff5d.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 578KB - Virtual size: 578KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ