General
- Target maybe.exe
- Size 19.2MB
- Sample261002-2d11yswx4l
- SHA256 ca6cc10327e84aae22983760ec1294d0c8e2410707975502fa177b420bb6191d
- MD5 61b1e7ae932ed54c697709270f1b1ccd
- SHA1 66d52a5d49f7328335e0b38370208fd75cbd66be
- SHA512 dd63ab4c8c5980d3ecb972f5bd34663e73ebd8ad35851f29195e36ce47e2466b1417cb232953a215097f5acd4c95b902a55bf3ec53e33673f83959ffa4ad3104
- SSDEEP 393216:s6QrsolMTAANqYbDHXuxjktlV9ot+SdiaHGa:s6Qrso9BYv3ulkt39o4RaH
- TLSH T16B173328BAFE7F54D9A95697EF9507B488CFEE0013038092C6B9311A670197FFBD0265
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
maybe.exe
Resource
win10v2004-20260911-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
maybe.exe
Resource
win11ltsc2024-20260911-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target maybe.exe
- Size 19.2MB
- SHA256 ca6cc10327e84aae22983760ec1294d0c8e2410707975502fa177b420bb6191d
- MD5 61b1e7ae932ed54c697709270f1b1ccd
- SHA1 66d52a5d49f7328335e0b38370208fd75cbd66be
- SHA512 dd63ab4c8c5980d3ecb972f5bd34663e73ebd8ad35851f29195e36ce47e2466b1417cb232953a215097f5acd4c95b902a55bf3ec53e33673f83959ffa4ad3104
- SSDEEP 393216:s6QrsolMTAANqYbDHXuxjktlV9ot+SdiaHGa:s6Qrso9BYv3ulkt39o4RaH
- TLSH T16B173328BAFE7F54D9A95697EF9507B488CFEE0013038092C6B9311A670197FFBD0265
- MD5 SHA1 SHA512 SSDEEP TLSH
Detects EvolutionStealer
Family: EvolutionStealer
EvolutionStealer is a Windows stealer written in Golang.
Suspicious use of NtCreateUserProcessOtherParentProcess
Executes dropped EXE
Suspicious use of SetThreadContext