General
- Target 04082026_1603_02082026_photo3.png.lnk.zip
- Size 1009B
- Sample260804-thbymahr4s
- SHA256 677cf97ff0910ddf4e82b7eeb98eef29badc7b01dfe823b8c9ce120205712c64
Score
10/10
Malware Config
Targets
-
- Target photo3.png.lnk
- Size 2KB
- SHA256 2a525de4ab0ab265ed695a7f89487715f412476182d5b5fd3606c971ed23898c
Score10/10Detects EvolutionStealer
Family: EvolutionStealer
EvolutionStealer is a Windows stealer written in Golang.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Adds Run key to start application