A forum for reverse engineering, OS internals and malware analysis 

Forum for analysis and discussion about malware.
 #31945  by ohdae
 Tue Aug 07, 2018 2:24 pm
File: b2ac53ffa2ee13e30ff0a78208d4c9b28251c00a3cd7e5345a07cd8664b943b1
Size: 46080
MD5: 379aa4c0fe0e2027e76341e075321fa0
SHA1: 8940ea910db97a4ecff02bd95218a2add8d728ce
SHA256: b2ac53ffa2ee13e30ff0a78208d4c9b28251c00a3cd7e5345a07cd8664b943b1

Pretty basic YARA rule strings for this sample here as well:
Code: Select all
	$name0 = "Evrial" ascii fullword
	$name1 = "Evrial.Hardware" ascii fullword
	$name2 = "Evrial.Cookies" ascii fullword
Thats^ the bare-minimum. I've let this hunting for awhile so I should have many more samples by EOD.