evelyn_stealer | f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

General

Target
f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29
Size 433KB
Sample260122-scvm4set5e
SHA256 f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29
MD5 8867093d2d5c13f3e2b05af9060109ef
SHA1 a4e2aabbdd41606de784ee1a6180186486ee61ba
SHA512 f47087eb9c9207ba94d48f1432e2656abef987dc46e486e9b4bade37f135eba0882030f62b7b73c144fe586731bac9c023bc2f97681b93d2ccbfd9d1dae62e4e
SSDEEP 12288:ZiLe96QwyyYjV3xcetmXlWglgicFTXmV:ZiLE6JyzjV32umXlVgiMT
TLSH
T19994E057B3E570F9D16793348AA54902EB72783107209BEF03E4E6691F236D05E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Evelyn Loader stage 1 IoCs

resource	yara_rule
sample	family_evelyn_loader

Evelyn_stealer family
evelyn_stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

File Explorer

f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

.exe 433KB

f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

IMPHASH d56fd62adb6d93e0b434c393bbb4391a
SHA256 f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29
MD5 8867093d2d5c13f3e2b05af9060109ef
SHA1 a4e2aabbdd41606de784ee1a6180186486ee61ba
SHA512 f47087eb9c9207ba94d48f1432e2656abef987dc46e486e9b4bade37f135eba0882030f62b7b73c144fe586731bac9c023bc2f97681b93d2ccbfd9d1dae62e4e
SSDEEP 12288:ZiLe96QwyyYjV3xcetmXlWglgicFTXmV:ZiLE6JyzjV32umXlVgiMT
TLSH
T19994E057B3E570F9D16793348AA54902EB72783107209BEF03E4E6691F236D05E3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Evelyn Loader stage
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary WriteConsoleW CreateFileW CloseHandle HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

ntdll

RtlCaptureContext RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

339KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

kernel32

ntdll

generic