Overview

overview

10

Static

static

10

cac98fd47f...f5.exe

windows7-x64

10

cac98fd47f...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5

  • Size

    1.3MB

  • Sample

    240825-f72npayekm

  • MD5

    14abfb51f8f57a091b87a733296c1523

  • SHA1

    947404f47050ef01f71493ccaec4f851f0c4eb30

  • SHA256

    cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5

  • SHA512

    61d1149f2c911fa99bebc24a7a5b40a096fa87ddd8b7c7e44fa9acf47af066c56ff048605453458cf864b48d1b06d2440921170d1f15e819f5ffc9d47b57520d

  • SSDEEP

    24576:/qPvbuhZUTd8hhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRX:obKo54clgLH+tkWJ0NJ

Score
10/10
echeloncredential_accessdiscoveryspywarestealer

Malware Config

Targets

    • Target

      cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5

    • Size

      1.3MB

    • MD5

      14abfb51f8f57a091b87a733296c1523

    • SHA1

      947404f47050ef01f71493ccaec4f851f0c4eb30

    • SHA256

      cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5

    • SHA512

      61d1149f2c911fa99bebc24a7a5b40a096fa87ddd8b7c7e44fa9acf47af066c56ff048605453458cf864b48d1b06d2440921170d1f15e819f5ffc9d47b57520d

    • SSDEEP

      24576:/qPvbuhZUTd8hhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRX:obKo54clgLH+tkWJ0NJ

    Score
    10/10
    echelondiscoveryspywarestealercredential_access

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks