evolution_stealer | f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109

Resubmissions

05/08/2026, 13:19

260805-qkg1wagn8s10

22/05/2026, 07:36

260522-jfftpafx5p10

22/05/2026, 07:35

260522-jeqbqsfx5j10

21/05/2026, 06:48

260521-hk8jtsay7y10

Sharing

Copy URL Twitter E-mail

General

Target
f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109
Size 8.7MB
Sample260522-jfftpafx5p
SHA256 f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109
MD5 1a8e730c1349027107784c2b269240ba
SHA1 d3d7b200f4c37b023479ab30a359af4febaf14e9
SHA512 f333266a454e714e32318f43c69b78ac07978fc9bc124e43bf696c7c4d13d7ea21144db5c42ec6dda43101efb00dde993500d8baf6bf419fa24f972aa572c242
SSDEEP 49152:IA+iQnvpJ1docaf25rASrtDKivrube+jLM3zSpXmwTevkbJGGdzWf2zPqsN1cmTy:IATuxJ+AgxbR0WPJu+fjDDV2eBYBEEX
TLSH
T1CC962907FDA524E8C0AEC13589769612BB717C491B3127D72B50F7282F7ABD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer evolution_stealer

Malware Config

Extracted

Family

evolution_stealer

wss://147.124.195.83:5173

Signatures

Family: EvolutionStealer
EvolutionStealer is a Windows stealer written in Golang.
stealer evolution_stealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109

File Explorer

f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109

.exe 8.7MB

f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109
MD5 1a8e730c1349027107784c2b269240ba
SHA1 d3d7b200f4c37b023479ab30a359af4febaf14e9
SHA512 f333266a454e714e32318f43c69b78ac07978fc9bc124e43bf696c7c4d13d7ea21144db5c42ec6dda43101efb00dde993500d8baf6bf419fa24f972aa572c242
SSDEEP 49152:IA+iQnvpJ1docaf25rASrtDKivrube+jLM3zSpXmwTevkbJGGdzWf2zPqsN1cmTy:IATuxJ+AgxbR0WPJu+fjDDV2eBYBEEX
TLSH
T1CC962907FDA524E8C0AEC13589769612BB717C491B3127D72B50F7282F7ABD0AEB9740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

557984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

426KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f301da9a67e417a53e2de53a7ed8d29910962743fa6464abf79d5dc76b2b8109

kernel32

generic