Extracted

• • Target

    config.exe

  • Size

    1.8MB

  • MD5

    69ece8d218a832b487ddb81d067342c8

  • SHA1

    9fa463b8b0a1abc771026bf1dd16e4b65d5f9f2f

  • SHA256

    1a36a58f9a4b757a07f99d0fc22c0e8fce99bf5191ac5cad4047acd3bb197961

  • SHA512

    10c58bdcd67d041f211c70b506454ca90a7216a95ab30ddf12281539daee55f8a302d88345280fd8c571189d0fb9875e874d01199ba7770e4ca6319a2ceb7468

  Score

  10^/10

  redlineytstealerinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4