EVOLUTION Stealer Staging Directory File Creation

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•11

Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.