General
- Target 04082026_1603_02082026_photo3.png.lnk.zip
- Size 1009B
- Sample260804-thbymahr4s
- SHA256 677cf97ff0910ddf4e82b7eeb98eef29badc7b01dfe823b8c9ce120205712c64
Score
10/10
Malware Config
Targets
-
- Target photo3.png.lnk
- Size 2KB
- SHA256 2a525de4ab0ab265ed695a7f89487715f412476182d5b5fd3606c971ed23898c
Score10/10-
Detects EvolutionStealer
-
Family: EvolutionStealer
EvolutionStealer is a Windows stealer written in Golang.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Adds Run key to start application