General
- Target safqt12.exe
- Size 10.0MB
- Sample261002-17f27sthlb
- SHA256 b965547b3dd2cafd9c5d962ef381196ac7112432518b7dd5362e5a21333882ed
- MD5 039695eb29376e6dab0d9548df1f9dd4
- SHA1 7a5c6fe5c661edc9f128708061d21c8de65d5d6a
- SHA512 654fab906a54caad65a702995ee2835d90d57e2684a672ad895a99288c01b2accd8dc22e9a23dfa409b70329222ac3603f41121b051fbd8e78cbdb03da246fc2
- SSDEEP 98304:ukxbrS5huMOrfAM3VaQXD9Pga4UtFDXv2tsBcllPO3Ha8Um5k3EUo37HMb:ukxbeR2laQJPgdU3DX+tsuPLLm5gGsb
- TLSH T1ACB63353B77F812AEEE47C3697684D7695C9CEC4B8C881B367400B7ADDAA70BC5148E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
safqt12.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Malware Config
Targets
-
- Target safqt12.exe
- Size 10.0MB
- SHA256 b965547b3dd2cafd9c5d962ef381196ac7112432518b7dd5362e5a21333882ed
- MD5 039695eb29376e6dab0d9548df1f9dd4
- SHA1 7a5c6fe5c661edc9f128708061d21c8de65d5d6a
- SHA512 654fab906a54caad65a702995ee2835d90d57e2684a672ad895a99288c01b2accd8dc22e9a23dfa409b70329222ac3603f41121b051fbd8e78cbdb03da246fc2
- SSDEEP 98304:ukxbrS5huMOrfAM3VaQXD9Pga4UtFDXv2tsBcllPO3Ha8Um5k3EUo37HMb:ukxbeR2laQJPgdU3DX+tsuPLLm5gGsb
- TLSH T1ACB63353B77F812AEEE47C3697684D7695C9CEC4B8C881B367400B7ADDAA70BC5148E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects EvolutionStealer
-
Family: EvolutionStealer
EvolutionStealer is a Windows stealer written in Golang.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Suspicious use of SetThreadContext