Extracted

• • Target

    Loader.exe

  • Size

    2.3MB

  • MD5

    2c3fad8035fdf8f16d554e6054b028fa

  • SHA1

    2c494bf2b1ff118c06a970ad235b73b0ca9cc9a0

  • SHA256

    d246fd45d287b669b26347e38d9231801d85b6e5baf8485f093090a7289aafbe

  • SHA512

    54fde453ca96d3a6879b47cccb7933880481fd2e4a527908eb6e57acfc640f50a486cb594c15df0422e3e6268e1e8bd2c4186e73ee33d606d83529e9dd105e7d

  Score

  6^/10

  spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Loader2.exe

  • Size

    4.6MB

  • MD5

    8b748c19d519e352be4672fbc6b3561d

  • SHA1

    ec7068896649caac57a04bf0fc101ddb4749861c

  • SHA256

    b95da2213bec289569d3d68a8e461b74b78c86dfcc1f5a794dceec5de1b6a811

  • SHA512

    f59964ccc2f3552e006a9ff1592aec7747d5355c053d9dd24e3fb5e907990e2339c6d37ea96243af88ceed8bd63318444143231f7d37b7966092be23e903833b

  Score

  10^/10

  redlineytstealerinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral3behavioral4