Analysis
-
max time kernel
52s -
max time network
181s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 02:10
Behavioral task
behavioral1
Sample
8d0fa32561337f0328dc4a8552f0ac3112788d3e86bd8f85acfca06b9007aac6.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
300 seconds
General
-
Target
8d0fa32561337f0328dc4a8552f0ac3112788d3e86bd8f85acfca06b9007aac6.exe
-
Size
4.0MB
-
MD5
5ac7525d3500ffc673de9bc4b62bed0b
-
SHA1
add3513dcbeebe5da9ec70a77c18dbeeb1d35eee
-
SHA256
8d0fa32561337f0328dc4a8552f0ac3112788d3e86bd8f85acfca06b9007aac6
-
SHA512
7c9262c2b05c301fd29c7134f0974ca3579e7f098fe556649215cf28c4200c69e3f03dcb6fab98c426da11f16943f5cb4d6cd86bdf6767821ac3f221d9602c3a
-
SSDEEP
98304:BAlAAJ25WKqrFAO4317DeQUstQccIvTEdg:BgAbJ3ZDeQU6Qcc4TEd
Malware Config
Signatures
-
YTStealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2684-116-0x0000000000F00000-0x0000000001D12000-memory.dmp family_ytstealer behavioral2/memory/2684-117-0x0000000000F00000-0x0000000001D12000-memory.dmp family_ytstealer -
Processes:
resource yara_rule behavioral2/memory/2684-115-0x0000000000F00000-0x0000000001D12000-memory.dmp upx behavioral2/memory/2684-116-0x0000000000F00000-0x0000000001D12000-memory.dmp upx behavioral2/memory/2684-117-0x0000000000F00000-0x0000000001D12000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.