Extracted

• • Target

    50cf1d78e64a81527acb3344a55b3dde.exe

  • Size

    3.9MB

  • MD5

    50cf1d78e64a81527acb3344a55b3dde

  • SHA1

    8477f910b3d33e64b156b0bcf091b92758c28d50

  • SHA256

    8029372ee0d847274003b41f70af056c577b82ad655ccaeb3163775e4bf1dcab

  • SHA512

    848a6f220aa287f71494ee7a77eae2e403ca87eadf8978857f6889ec1f84d91b5343e1ac103b43e438b669e2a66cc9da77c0478535fb89d2d12ac260c2ef3409

  Score

  10^/10

  redlineytstealerinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2