Extracted

• • Target

    e25ce9c2b5d24744369835f590f91d1a.exe

  • Size

    3.9MB

  • MD5

    e25ce9c2b5d24744369835f590f91d1a

  • SHA1

    73b7c7c2cd35864ed4fe3969f8f8dc4242900ac1

  • SHA256

    6ace84c8a5b97075e435df18a59c7dcaa90091c8b3140deedf5139329d1890df

  • SHA512

    7c949da1f0cbdd49198f8ccb07b67a4222f1f3c9c9451bd7e871bb7561f5cd77a6f45006a3324a511cde7c216622c1811244ae03795e2106536e613325adee73

  Score

  10^/10

  redlineytstealerinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2