General

  • Target

    012004bffb762db987ee4d432d5a45dbbc82b9cd1280b5a0a8daf5a0dc9111f6

  • Size

    4.0MB

  • Sample

    220830-bkjr5shegn

  • MD5

    11e297d097bff88e58835867e494d1a2

  • SHA1

    d97bb1ac9a51523e88d81c4784d1357d40402e7c

  • SHA256

    012004bffb762db987ee4d432d5a45dbbc82b9cd1280b5a0a8daf5a0dc9111f6

  • SHA512

    20b7c28e56e022da450977f8e3a7cd7c5e8e0610419aabc5ba5a6eb9bdf91b6d35f17161e3ba99af1c088fb3081ca236923062d69d6f4fc369f975e807f73cef

  • SSDEEP

    98304:3r1poVKykpQU06bbjADiUO1+f0LRssPPyHyRjv2:3rzoVKygS6bbfjAIPyHov

Malware Config

Targets

    • Target

      012004bffb762db987ee4d432d5a45dbbc82b9cd1280b5a0a8daf5a0dc9111f6

    • Size

      4.0MB

    • MD5

      11e297d097bff88e58835867e494d1a2

    • SHA1

      d97bb1ac9a51523e88d81c4784d1357d40402e7c

    • SHA256

      012004bffb762db987ee4d432d5a45dbbc82b9cd1280b5a0a8daf5a0dc9111f6

    • SHA512

      20b7c28e56e022da450977f8e3a7cd7c5e8e0610419aabc5ba5a6eb9bdf91b6d35f17161e3ba99af1c088fb3081ca236923062d69d6f4fc369f975e807f73cef

    • SSDEEP

      98304:3r1poVKykpQU06bbjADiUO1+f0LRssPPyHyRjv2:3rzoVKygS6bbfjAIPyHov

    • YTStealer

      YTStealer is a malware designed to steal YouTube authentication cookies.

    • YTStealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks