Extracted

• • Target
    96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe
  • Size 165KB
  • SHA256 96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306
  • MD5 26df83060d7aa09e6adbf8db4739394d
  • SHA1 6a4105d904ad9f68454cda2fd86992cf803780a4
  • SHA512 da5eb096f51376a401e5c389a0b872e6f28de2e18a94eae262ce16fdd10cdf594dc09720bfcd552beb60ab92b2e1eab98adf0a4351fffdf6be26ab9a3d985151
  • SSDEEP 1536:6sppsoWPy6wpnj3VIXQYh/shPvByWEUUq8Wsn5oNogAZ/ZPfcUv9SUKonYw1xxNx:EPyBjgmBWC8WsnGdAvt9SnonYw/giCO
  • TLSH
    T15EF3F906B3D720ACE577D1349ABBE173BA33BC254630AD6E655489383E21F50B938F16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  browserkitdiscoveryevelyn_stealerloaderspywarestealer

  • Detects Evelyn Stealer payload

  • Family: EvelynStealer

    Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.

    stealerloaderbrowserkitevelyn_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2