Extracted

• • Target

    setup.exe

  • Size

    7.8MB

  • MD5

    785ec578688eea5954c58fc5aaae01db

  • SHA1

    631e3dcb1e26ca403dcb27b3b8ca02e43fb7f892

  • SHA256

    de422863cd1d6fc32ed020e93643e24f11dfed84d7ac62de2b8e9d0b38563237

  • SHA512

    085683845f328b1675676297bbaec7634daf8aae4391d82fc66bbad6a36b1f630a6ab7184b3ad7701fb1922d53bab8f70101261124bc3bb85e1b8a8e964f20eb

  Score

  10^/10

  redlineytstealerinfostealerspywarestealerupx

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2