Overview

overview

10

Static

static

10

2026-05-22...ch.exe

windows10-2004-x64

10

Resubmissions

31/07/2026, 15:47

260731-s77adsbj3y10

22/05/2026, 02:58

260522-dgdstsfz417

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-05-22_7241b47bc9b77446c8a8714f564f9845_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 8.5MB
  • Sample260731-s77adsbj3y
  • SHA256 6fdc01c4ea563cc23e3f131661bc7aef08e7a113bf9dfd7da9e47e7ee1f4bb8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
evolution_stealerpersistenceprivilege_escalationstealer

Malware Config

Extracted

Family

  • evolution_stealer

C2

  • wss://46.151.182.231:5173

Targets

    • Target
      2026-05-22_7241b47bc9b77446c8a8714f564f9845_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
    • Size 8.5MB
    • SHA256 6fdc01c4ea563cc23e3f131661bc7aef08e7a113bf9dfd7da9e47e7ee1f4bb8e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    evolution_stealerpersistenceprivilege_escalationstealer

    • Detects EvolutionStealer

    • Family: EvolutionStealer

      EvolutionStealer is a Windows stealer written in Golang.

      stealerevolution_stealer

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks