Overview

overview

10

Static

static

10

Echelon.exe

windows7-x64

10

Echelon.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Echelon.exe

  • Size

    778KB

  • Sample

    240924-yblayavbqe

  • MD5

    76af6669d9635ffe4fdbf97af1a57fa6

  • SHA1

    d3cba94b74f67e8d98cfa89209748ea2701bef80

  • SHA256

    cab5dcf0af0ee68bc7113ab59e08ef43f2a62c8538afb2d96e154fc6fd19b9f0

  • SHA512

    11fc1464800a4481865649cd71815f8d5be79d28bf36e6d56ffac65ce9564e346b22f73e8f0404efba5687e2291a4530f4ff125e580b2f62ec377a2c2bf743e7

  • SSDEEP

    24576:9FYpeHEsokNLQyhFoVdJOlc8msV0EWRr:6ASumJmc8mW0d

Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Targets

    • Target

      Echelon.exe

    • Size

      778KB

    • MD5

      76af6669d9635ffe4fdbf97af1a57fa6

    • SHA1

      d3cba94b74f67e8d98cfa89209748ea2701bef80

    • SHA256

      cab5dcf0af0ee68bc7113ab59e08ef43f2a62c8538afb2d96e154fc6fd19b9f0

    • SHA512

      11fc1464800a4481865649cd71815f8d5be79d28bf36e6d56ffac65ce9564e346b22f73e8f0404efba5687e2291a4530f4ff125e580b2f62ec377a2c2bf743e7

    • SSDEEP

      24576:9FYpeHEsokNLQyhFoVdJOlc8msV0EWRr:6ASumJmc8mW0d

    Score
    10/10
    echelonspywarestealercollectiondiscovery

    • Detects Echelon Stealer payload

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks