ytstealer | 2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e

Analysis

max time kernel
250s
max time network
281s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-08-2022 01:33

Target

2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e.exe
Size

4.0MB
MD5

f5c9a86d3405816dd987976a96793a96
SHA1

7ed293f0cf8426b4bfbb8d0144fe3fb97e2d6c83
SHA256

2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e
SHA512

a76f56de3c8d5721d6f6550b3e3275f78bdc4bfed32fefdcd62cde69ff2c1966c6e7332f3675885fef2d9c32240f77ed53fc993673e60a431a81f23fba91d958
SSDEEP

98304:DiWCL/rtIkroAEl7GNo4dHHFATQqpDjKD:yS/NWo4dHl4QqpDjK

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-54-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	family_ytstealer
behavioral1/memory/1708-55-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	family_ytstealer
behavioral1/memory/1708-56-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	family_ytstealer

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1708-54-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	upx
behavioral1/memory/1708-55-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	upx
behavioral1/memory/1708-56-0x0000000000CC0000-0x0000000001AD4000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e.exe
"C:\Users\Admin\AppData\Local\Temp\2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e.exe"
1⤵
PID:1708

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1708-54-0x0000000000CC0000-0x0000000001AD4000-memory.dmp

Filesize
14.1MB

Download
memory/1708-55-0x0000000000CC0000-0x0000000001AD4000-memory.dmp

Filesize
14.1MB

Download
memory/1708-56-0x0000000000CC0000-0x0000000001AD4000-memory.dmp

Filesize
14.1MB

Download