MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


EvelynStealer


Vendor detections: 11


Intelligence 11 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa
SHA3-384 hash: 0caadca0748ec366a9b0aebb6ab018aa79ab521a6cec10198f778f06a95a9926aca56db339e84446663f2076c49b46fa
SHA1 hash: e41ee751e56d9eb7910fce1a1bd86fada1589e6a
MD5 hash: 87c1674e6e889d7ec413d5fbdf061d8f
humanhash: bakerloo-equal-avocado-network
File name:file
Download: download sample
Signature EvelynStealer
Create hunting rule
File size:261'019 bytes
First seen:2026-02-08 22:11:16 UTC
Last seen:2026-02-08 22:22:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f7915780c9de5af71b55c8180dfe3cf3 (1 x EvelynStealer)
ssdeep 6144:ayM/zplxKdujZIZZZcJP5L54JPA5gppbMt+wcM:ay+FlxKE+4+wcM
TLSH T17E44C461EAD61C49F9738378AED29272297CFDA4D121F75F712411203F07AA0BFA8746
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Bitsight
Tags:dropped-by-amadey EvelynStealer exe fbf543


Avatar
Bitsight
url: http://130.12.180.43/files/504463127/BU3o4QJ.exe

Intelligence

File Origin
# of uploads :
13
# of downloads :
182
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa.exe
Verdict:
Malicious activity
Analysis date:
2026-02-08 22:12:52 UTC
Tags:
loader stealer evasion arch-doc
Link:
https://app.any.run/tasks/0147eadb-ab90-432a-928d-d7971b57faed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/52708/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69890a4642fd65534ccda3b4
Tags:
infosteal emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending an HTTP GET request
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Loading a suspicious library
Creating a window
Searching for synchronization primitives
Сreating synchronization primitives
Creating a file in the Program Files subdirectories
Creating a file
Reading critical registry keys
Sending a custom TCP request
Unauthorized injection to a recently created process
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug fingerprint overlay packed soft-404
Link:
https://www.filescan.io/uploads/69890a442ffccda0976ace43/reports/4a8579c6-defa-4732-85ec-7687746058c1/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa
Result
Gathering data
Verdict:
Malicious
File Type:
exe x64
Detections:
Trojan-PSW.MSIL.Stealer.sb Trojan.Win32.Udochka.sb HEUR:Trojan-PSW.Win32.Greedy.gen Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan-PSW.Win32.BroPass.sb Trojan-PSW.Win32.Agent.sb
Link:
https://opentip.kaspersky.com/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/7edd02a9-b3b1-4067-ba33-530cc5364d34
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/87c1674e6e889d7ec413d5fbdf061d8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa/
Verdict:
Malicious
Threat:
Family.EVELYN_STEALER
Link:
https://tip.neiki.dev/file/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7sofggjk4aimomczslqpsllavt6been5dawjwhfbuzikqvg3d5a._file
Result
Malware family:
evelyn_stealer
Create hunting rule
Score:
  10/10
Tags:
family:evelyn_stealer browserkit discovery loader spyware stealer
Link:
https://tria.ge/reports/260208-14m2cac19a/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Time Discovery
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Detects Evelyn Stealer payload
EvelynStealer
Evelyn_stealer family
Unpacked files
SH256 hash:
97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa
MD5 hash:
87c1674e6e889d7ec413d5fbdf061d8f
SHA1 hash:
e41ee751e56d9eb7910fce1a1bd86fada1589e6a
Link:
https://www.unpac.me/results/66086e9c-6ed0-4abb-bcae-7a862ce77ae4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/97e4e298c957/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__RemoteAPI
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
Create hunting rule
Author:ditekSHen
Description:Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Rule name:Macos_Infostealer_Wallets_8e469ea0
Create hunting rule
Author:Elastic Security
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

EvelynStealer

Executable exe 97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3774854/
Cape
Cape
https://www.capesandbox.com/analysis/52708/

Comments