Extracted

• • Target

    e41691f13cc15a0240d3845849f87e46d1d44d1644fffd7da4164cb14879abb2

  • Size

    172KB

  • MD5

    2e3313bdd85004ca6df84c55b6d1e8f1

  • SHA1

    3808575abc4b598c7e60c5d0e447a08ebf4c3df4

  • SHA256

    e41691f13cc15a0240d3845849f87e46d1d44d1644fffd7da4164cb14879abb2

  • SHA512

    ab90ec3b86bf7e1832464e26d5100751c9194231c1e06228725189c22fe6a90a3035fc5f24af8b923faa4d7fb959ecf32c39beca4883ea5c764c74c979b6e245

  Score

  10^/10

  redlineytstealerafter6infostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Uses the VBS compiler for execution

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2