TL;DR
- Modelorat: A specialized remote access trojan installed as part of the CrashFix campaign via a fraudulent browser extension. It provides system control, reconnaissance, persistence, and interaction with C2 via an encrypted channel.
- Sirkeira: A publicly available infostealer that collects endpoint artifacts into a temporary package and uploads it to remote file-sharing services or C2.
- Evelyn Stealer: An infostealer targeting developers through abuse of Visual Studio Code extensions, collecting browser credentials, cryptocurrency wallets, and other data with exfiltration via FTP.
- Symbiote: A Windows stealer that uses multiple techniques, including process injection and adding itself to defense tool exclusions.
1) Modelorat (Windows/Python)
Sample: ANY.RUN
Modelorat is a Python-based remote access trojan (RAT) installed as part of the CrashFix campaign via a fraudulent browser extension. The RAT gains control over the compromised system, performs environment reconnaissance, establishes persistence, accepts commands, and ensures interaction with the command server via an encrypted channel. The delivery mechanism requires user involvement: after installing the fake extension, the browser forcibly "crashes," displaying a false prompt to run a command, leading to the execution of a PowerShell chain and installation of Modelorat. The mechanics are oriented toward corporate systems, with the RAT using defense evasion tools and standard OS utilities to load and execute payload components.
How to detect: Detection is based on the persistence mechanism via the registry key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with autorun name MonitoringService.
Key facts:
- Distributed via the ClickFix variant "CrashFix" using the fraudulent extension “NexShield,” which masquerades as uBlock Origin Lite and prompts the user to run malicious commands.
- The RAT is deliberately installed on domain/corporate systems, skipping ordinary home hosts.
- Supports environment reconnaissance, persistence, and remote command execution after installation.
- Communications with C2 are performed via encrypted channels, and the RAT itself has basic anti-analysis functions and can be updated.
- Uses standard OS utilities (e.g., Finger.exe) and PowerShell chains to load the next stage and bypass basic protections.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-09 | News | 2026-02-17 | 2 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
registryName:"^MonitoringService$"
IOCs:
- SHA256:
c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6 - Persistence Registry Key:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MonitoringService
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1059.001 | PowerShell | Initial loading and execution via PowerShell chain after social engineering |
| T1547.001 | Registry Run Keys / Startup Folder | Creates autorun via HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value MonitoringService |
| T1053 | Scheduled Task / Job | Uses scheduler mechanisms or system calls for repeated launches |
| T1105 | Ingress Tool Transfer | Downloads additional components from a remote server |
| T1071.001 | Web Protocols | Communication with C2 is carried out via HTTP/HTTPS |
| T1082 | System Information Discovery | Collects system information before executing commands |
| T1059 | Command and Control Execution | Executes commands received from C2 on the infected system |
2) Sirkeira (Windows)
Sample: ANY.RUN
Sirkeira is a publicly available infostealer (source code and forks available on GitHub) that collects endpoint artifacts into a temporary package for each user and uploads this package to remote file-sharing services / C2. Observed samples aggregate browser cookies/history, account lists (Discord, Roblox), minimal password indicators, antivirus info, and a short system report, then transmit the package to third-party upload endpoints.
How to detect: Detection is based on identifying specific artifacts of malware presence in the operating system. Primarily, this includes the presence of a ZIP archive in the local temp folder whose file path matches the regex C:\Users\\AppData\Local\Temp\SK_\d{8,14}.zip$/i.
Key facts:
- The archive with stolen data contains short text reports and folders with collected items — for example, small text files for antivirus info, browsing history, cookies, account lists (Discord/Roblox), passwords, and system_infos.txt; plus an Extensions tree with collected browser extension folders (Chrome/Edge extension IDs).
- Source code/variants: public source code/forks exist on GitHub; behavior may vary between forks/samples.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-10 | Tweet | 2026-02-14 | 11 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"temp\\SK_*.zip$"
IOCs:
- SHA256:
0853774c3d4533915d767fa09e11c1eaa18f4212cb18d9d7ab15d3e3eda6fcd2 - SHA256:
a6e7292e734c3a15cfa654bba8dea72a2f55f1c24cf6bbdc2fd7e63887e9315a - SHA256:
990d1ff1ab883a9bacbbb6abcf975139d9ab359b74ffba16f1fa7a66a30e935d - SHA256:
f6019bcd2f054da99762741b3dc03a1c33d5be8f9840ce0570225dfc85b35467 - SHA256:
e3e3c5b9388582cbd945fb35cefc330c7828ad4b21c92ba215fd8bc95134444e - SHA256:
419cb30c7f4e5b145830066558fe196c5d95a25a5965e73952842948af7fdbb5
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1555.003 | Credentials from Web Browsers | Cookies and browsing history files included in archive. |
| T1071.001 | Application Layer Protocol: Web Protocols | TLS traffic to discord |
| T1041 | Exfiltration Over C2 Channel | Bulk upload of archive to third-party file hosting observed. |
| T1552.001 | Credentials in Files | Account text files (Discord/Roblox) and other session artifacts collected into ZIP. |
| T1113 | Screen Capture | The stealer can take screenshots of the screen and archive them with other information. |
3) Evelyn Stealer (Windows)
Sample: ANY.RUN
Evelyn Stealer is an infostealer targeting developers through abuse of Microsoft Visual Studio Code extensions. The malware is distributed via modified extensions that, upon installation, inject a DLL library and use hidden execution techniques to minimize visibility. It collects browser credentials, cryptocurrency wallets, Wi-Fi keys, and other confidential data, which are then sent to the attackers' server via FTP. The stealer masquerades as legitimate components and uses multi-stage loading, making it difficult to detect and analyze.
How to detect: Detection of Evelyn is based on identifying specific file artifacts associated with its activity on the endpoint system. Specifically, files located in the ProgramData directory are analyzed, including files such as C:\ProgramData\Evelyn\FTP\FileZilla\filezilla.xml, Installed_Programs.txt, Processes.txt, Screenshot.png, System_Info.txt, WiFi_Passwords.txt, and autofills.txt. These files contain data collected by the stealer, including information about programs, processes, screenshots, and passwords. The presence of such files in the specified directory allows unambiguous identification of Evelyn's presence on the system and classification of the activity as a known threat.
Key facts:
- Applies several unique techniques that allow it to effectively hide its activity and ensure long-term presence on compromised systems.
- The stealer uses DLL-side-loading
- Data is sent to the command server via FTP.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-10 | News | 2026-02-18 | 9 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"C:\\ProgramData\\Evelyn"
IOCs:
- SHA256:
97e4e298c95700863982cc9707c96b0567e0908de8c164d8e50d328542a6d8fa - SHA256:
5c5ee74b9115ff8444eda51c18d22e4ccb7f35cbeb062bded258c04b66b5b91f - SHA256:
169d8a39a164b7a0369191213a91da7213b9e233a71db307d616f1c2a09e9daa
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1071.001 | Application Layer Protocol: Web Protocols | C2 communication via FTP using a standard protocol for data transmission. |
| T1041 | Exfiltration Over Command and Control Channel | Transmission of collected data (passwords, files, screenshots) to the attacker's server via FTP. |
| T1105 | Ingress Tool Transfer | Downloading files from the C2 server to continue malicious activity. |
| T1074 | Data Staged | Collection and preparation of data (e.g., Wi-Fi password files and screenshots) on the infected system. |
| T1016 | System Network Configuration Discovery | Collection of network and device information, including Wi-Fi passwords and VPN settings. |
| T1053 | Scheduled Task: Scheduled Task Creation | Creation of tasks in the scheduler for automatic loading and launching of malicious programs. |
| T1070.004 | Indicator Removal on Host: File Deletion | Removal of traces of activity, such as files, including logs and confidential data. |
| T1083 | File and Directory Discovery | Exploration of the file system to collect information about system settings and user data. |
| T1056.001 | Input Capture: Keylogging | Recording keystrokes to capture confidential information, including passwords. |
| T1020 | Automated Exfiltration: Exfiltration Over Web Service | Exploitation of standard web services (e.g., FTP) for covert data transmission. |
4) Symbiote (Windows)
Sample: ANY.RUN
Symbiote is a Windows-based stealer that employs multiple techniques to maintain persistence and evade detection.
How to detect: Detected by monitoring anomalous activity related to process injection and file behavior.
Key facts:
- Symbiote uses an injector to inject itself into EXPLORER.EXE and PowerShell to add itself to exclusions.
Analytical note:
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-10 | Sandbox | 2026-02-18 | 1 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
filePath:"*\\Symbiote.exe$"
IOCs:
- SHA256:
a6cd9bc5901e4296ea6efee65df74770bb1c2a987e1c26d2d5068ebe51d74b94 - SHA256:
444eef853b8494ede301cca254e1880abcc9bc11c829e7cf83fd71607972a028 - SHA256:
aedb2baa1c8eed2342b2dc23b8d3ad2f74f47658ac8cf8b50a175ee58c551c91 - SHA256:
6f023bf1aed6f59754bc5a69778c68b60dc825d19912cb4f2293c0035f639922 - SHA256:
83d541adf67f17dd861bf8700f80230678d261d386b4be78be7456c22b06f220 - SHA256:
e8540681a9497133b6c061c1b7edfea58fe304ec83fe5e25681c267e97872238 - SHA256:
6c4d2c43fba282aebf509f98b469fabf2163b5c75275b96f9d9801dbf70fa93e - SHA256:
2c59a5458121c36355cc7128163bf630e87b24df9c5b25bfa985c931ff41713b - SHA256:
fa4f2c97f4864cbfa0e8feccb5c619f7a1df839632a7806e8c985a32c4147902 - SHA256:
04db2a78ea124a420d07d748a19c679e580aad4d34b237c907e1b0f65b2224ed
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1059 | Command and Scripting Interpreter: PowerShell | The script adds the process to Windows Defender exclusions |
| T1562 | Impair Defenses: Disable or Modify Tools | Modifies Windows Defender settings |
| T1012 | Query Registry | Checks multiple registries |
| T1082 | System Information Discovery | Reads the computer name |
Conclusion
1) Delivery via browser extensions: Modelorat and Evelyn demonstrate the use of legitimate platforms like browser stores for RAT distribution.
2) ClickFix as a new field for experiments: Modelorat is distributed via a ClickFix variation with browser crash simulation.
3) Variety of forks: The presence of source code in open access guarantees the appearance of forks.