evelyn_stealer | 96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe
Size 165KB
Sample260420-2vb36aez2m
SHA256 96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306
MD5 26df83060d7aa09e6adbf8db4739394d
SHA1 6a4105d904ad9f68454cda2fd86992cf803780a4
SHA512 da5eb096f51376a401e5c389a0b872e6f28de2e18a94eae262ce16fdd10cdf594dc09720bfcd552beb60ab92b2e1eab98adf0a4351fffdf6be26ab9a3d985151
SSDEEP 1536:6sppsoWPy6wpnj3VIXQYh/shPvByWEUUq8Wsn5oNogAZ/ZPfcUv9SUKonYw1xxNx:EPyBjgmBWC8WsnGdAvt9SnonYw/giCO
TLSH
T15EF3F906B3D720ACE577D1349ABBE173BA33BC254630AD6E655489383E21F50B938F16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer loader browserkit evelyn_stealer

Malware Config

Signatures

Family: EvelynStealer
Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.
stealer loader browserkit evelyn_stealer

Detects Evelyn Stealer payload 1 IoCs

resource	yara_rule
sample	family_evelyn_stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe

File Explorer

96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe

.exe 165KB

96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe

IMPHASH ddba7c71bf9688b3086b26f8a636070e
SHA256 96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306
MD5 26df83060d7aa09e6adbf8db4739394d
SHA1 6a4105d904ad9f68454cda2fd86992cf803780a4
SHA512 da5eb096f51376a401e5c389a0b872e6f28de2e18a94eae262ce16fdd10cdf594dc09720bfcd552beb60ab92b2e1eab98adf0a4351fffdf6be26ab9a3d985151
SSDEEP 1536:6sppsoWPy6wpnj3VIXQYh/shPvByWEUUq8Wsn5oNogAZ/ZPfcUv9SUKonYw1xxNx:EPyBjgmBWC8WsnGdAvt9SnonYw/giCO
TLSH
T15EF3F906B3D720ACE577D1349ABBE173BA33BC254630AD6E655489383E21F50B938F16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Evelyn Stealer payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle CreatePipe DeleteCriticalSection DeleteFileW EnterCriticalSection FreeLibrary GetComputerNameA GetComputerNameW GetCurrentProcess GetDiskFreeSpaceExW GetExitCodeProcess GetLastError GetLocalTime GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetStdHandle GetTickCount GetVolumeInformationA GlobalMemoryStatusEx InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _lock _onexit _snprintf _strdup fwprintf _unlock _wcsicmp abort atoi calloc exit fflush fprintf fputc fputwc free fwrite localeconv malloc memcpy memset qsort realloc signal strchr strcmp strerror strlen strncmp strncpy strstr vfprintf wcslen wcsstr _snwprintf

user32

MessageBoxW

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

96f9041d51a3af2adf15f11f146e33eaf194bc04730d41718ad711f068e22306_bf6dd333-aa36-4e5c-b15a-bd6408c36d7e.exe

advapi32

kernel32

msvcrt

user32

generic