General
- Target d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1_77170f53-7893-467e-8960-d09c15a370e3.exe
- Size 196KB
- Sample260420-2l9casex7k
- SHA256 d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1
Malware Config
Targets
-
- Target d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1_77170f53-7893-467e-8960-d09c15a370e3.exe
- Size 196KB
- SHA256 d1dfdf2ccba9e5c48800f8ad3509c739e32496e881a97297ea31778fcbaeb3a1
Score10/10Detects Evelyn Stealer payload
Family: EvelynStealer
Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3