General
- Target d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1_77170f53-7893-467e-8960-d09c15a370e3.exe
- Size 196KB
- Sample260420-2l9casex7k
- SHA256 d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1
Malware Config
Targets
-
- Target d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1_77170f53-7893-467e-8960-d09c15a370e3.exe
- Size 196KB
- SHA256 d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1
Score10/10-
Detects Evelyn Stealer payload
-
Family: EvelynStealer
Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3