Analysis
-
max time kernel
245s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 01:18
Behavioral task
behavioral1
Sample
158d4576630484fd392c3a838edff80093773070c9850c26df0414fe116a7353.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
300 seconds
General
-
Target
158d4576630484fd392c3a838edff80093773070c9850c26df0414fe116a7353.exe
-
Size
4.0MB
-
MD5
e8c145795647899471c87cbfe83dcede
-
SHA1
59d5a8c3b33fa040102bdfc1b9aa6b06549029ca
-
SHA256
158d4576630484fd392c3a838edff80093773070c9850c26df0414fe116a7353
-
SHA512
3e2977200a5e5ee4895e0beba04ce328bd96565b7dd1a3a140ab4936576b168ced6d4178dbc9e2ba0e797cc69d2c2cd43a8920317254f7ed157ed22f69e3b76e
-
SSDEEP
98304:5wbvIX8zbDH8RkZcgkLiSg3iPr6GYQNgZWp1odGOmC:5B8Pr8ccRng3dGfNyWIdnmC
Malware Config
Signatures
-
YTStealer payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1528-54-0x0000000000010000-0x0000000000E22000-memory.dmp family_ytstealer behavioral1/memory/1528-55-0x0000000000010000-0x0000000000E22000-memory.dmp family_ytstealer behavioral1/memory/1528-56-0x0000000000010000-0x0000000000E22000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral1/memory/1528-54-0x0000000000010000-0x0000000000E22000-memory.dmp upx behavioral1/memory/1528-55-0x0000000000010000-0x0000000000E22000-memory.dmp upx behavioral1/memory/1528-56-0x0000000000010000-0x0000000000E22000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.