Extracted

• • Target
    0a4a7e30e34d9432749e11fb6343deeb4676b919b6568bdb5bb62a8fc3fb3c3f_nethost.dll.exe
  • Size 104KB
  • SHA256 0a4a7e30e34d9432749e11fb6343deeb4676b919b6568bdb5bb62a8fc3fb3c3f
  • MD5 7461d08e73c953ff86fac4d395fd643e
  • SHA1 006e2bac7d9dd245ec7ff71c0a0f11944a5b2f24
  • SHA512 fdddd869458366e7a50dc59c89fd274f6e201aa85347a38762909cef23e0663c4f981eaaa501adda5386f0d78fc8ce9d0dcaf6e4cded25f9f84e9952c981673e
  • SSDEEP 3072:GEHzKjpAqVexNGpAQbUwkhyMI8vmSO/7njPL3cIbHD2GgNJlLJKNryjuFbHV3MGy:GDjpVVevtMUwkhHKl1
  • TLSH
    T1BBA36A47A2EA00BBE2B78678C4530A4AE776B85507616FFF43A4424A1F273D18D3DF61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  browserkitdiscoveryevelyn_stealerloaderpersistencespywarestealer

  • Detects Evelyn Stealer payload

  • Family: EvelynStealer

    Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.

    stealerloaderbrowserkitevelyn_stealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2