ytstealer | 30661f3565b06b2845f9a94c23d74086ab558b5dacd62395e6ea020dbbd3ed7f

Analysis

max time kernel
245s
max time network
53s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-08-2022 01:34

Target

30661f3565b06b2845f9a94c23d74086ab558b5dacd62395e6ea020dbbd3ed7f.exe
Size

4.0MB
MD5

790fa52a30832fba845d4d6fc7741583
SHA1

80b2073db7aaac2d69f7c0dac1ed17eb663a4a23
SHA256

30661f3565b06b2845f9a94c23d74086ab558b5dacd62395e6ea020dbbd3ed7f
SHA512

192c2e7953e06d6d27fad2740c5cdc77ed24c1f7fc6ce88d196a26d26548ca43d8cabda85fe17041083054fd6b8d7f7046fa6ce86be0fed90ebe27fab6083577
SSDEEP

98304:J3a1MWnXJ1OTSamNmdaX6V+xHT5wSiMy8rfXJA75:dapX4haKV+FNRB+N

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/536-54-0x0000000000C80000-0x0000000001A92000-memory.dmp	family_ytstealer
behavioral1/memory/536-55-0x0000000000C80000-0x0000000001A92000-memory.dmp	family_ytstealer
behavioral1/memory/536-56-0x0000000000C80000-0x0000000001A92000-memory.dmp	family_ytstealer

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/536-54-0x0000000000C80000-0x0000000001A92000-memory.dmp	upx
behavioral1/memory/536-55-0x0000000000C80000-0x0000000001A92000-memory.dmp	upx
behavioral1/memory/536-56-0x0000000000C80000-0x0000000001A92000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

C:\Users\Admin\AppData\Local\Temp\30661f3565b06b2845f9a94c23d74086ab558b5dacd62395e6ea020dbbd3ed7f.exe
"C:\Users\Admin\AppData\Local\Temp\30661f3565b06b2845f9a94c23d74086ab558b5dacd62395e6ea020dbbd3ed7f.exe"
1⤵
PID:536

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/536-54-0x0000000000C80000-0x0000000001A92000-memory.dmp

Filesize
14.1MB

Download
memory/536-55-0x0000000000C80000-0x0000000001A92000-memory.dmp

Filesize
14.1MB

Download
memory/536-56-0x0000000000C80000-0x0000000001A92000-memory.dmp

Filesize
14.1MB

Download