C:\Users\chris\Desktop\heck\heck\Anarchy\Oxide-Src\Echelon Stealer\obj\Release\Echelon.pdb
Behavioral task
behavioral1
Sample
Echelon.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Echelon.exe
Resource
win10v2004-20240802-en
General
-
Target
Echelon.exe
-
Size
778KB
-
MD5
76af6669d9635ffe4fdbf97af1a57fa6
-
SHA1
d3cba94b74f67e8d98cfa89209748ea2701bef80
-
SHA256
cab5dcf0af0ee68bc7113ab59e08ef43f2a62c8538afb2d96e154fc6fd19b9f0
-
SHA512
11fc1464800a4481865649cd71815f8d5be79d28bf36e6d56ffac65ce9564e346b22f73e8f0404efba5687e2291a4530f4ff125e580b2f62ec377a2c2bf743e7
-
SSDEEP
24576:9FYpeHEsokNLQyhFoVdJOlc8msV0EWRr:6ASumJmc8mW0d
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule sample family_echelon -
Echelon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Echelon.exe
Files
-
Echelon.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 775KB - Virtual size: 775KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ