Extracted

Extracted

Extracted

Extracted

• • Target

    0x0007000000012770-95.dat

  • Size

    402KB

  • MD5

    06ee576f9fdc477c6a91f27e56339792

  • SHA1

    4302b67c8546d128f3e0ab830df53652f36f4bb0

  • SHA256

    035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8

  • SHA512

    e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616

  • SSDEEP

    6144:tMfrO6FHMcQTkvu0aaQEv1pE0EAPMrGWsWDWidF0HQszCZ2Ftppb9Y81+k7pq7FX:tsOUHzvu0aaRS2z2

  Score

  10^/10

  privateloaderredlineytstealernam6.1ruzki7evasioninfostealerloadermainspywarestealertrojanupx

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2