Extracted

• • Target
    c82762647dc8ec40838013752ad4ba14a9a203368af3edfc2d5e8774034f4a6d_d8f17512-f1d6-4a13-8e32-1b3991991ae2.exe
  • Size 164KB
  • SHA256 c82762647dc8ec40838013752ad4ba14a9a203368af3edfc2d5e8774034f4a6d
  • MD5 df1e311b0fc6441fc11aa77b7666dfcf
  • SHA1 502e042af677919eda3750d9976247455ebaab9d
  • SHA512 f0272f56260ada2cab8a0f9680d7a6f9696457c8e7c26e4bd538c63a7300f10379936cdb4cdbda695e8d5d61d8519b64980f89f52c7583cddaaceed1aae203ce
  • SSDEEP 3072:2ER8njmuYv15ostIyzv52deTP/NSYXXFYw1giCh:h8njm992sm22deL/jXFt
  • TLSH
    T139F30902B39720ECE577D1345ABBE133BA73FC654630A95E65448A383E11F50BA78F16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  browserkitdiscoveryevelyn_stealerloaderspywarestealer

  • Detects Evelyn Stealer payload

  • Family: EvelynStealer

    Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.

    stealerloaderbrowserkitevelyn_stealer

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2