General

  • Target

    9ec83314112951d92b0146f574b66a0dbf706fc4741c610e851f54f2fbfecd0a

  • Size

    4.0MB

  • Sample

    220830-cnes2abdg2

  • MD5

    d6726e58e827b86f19edbf24045a8a5b

  • SHA1

    511a55b5c461888260b7e5ac6a9efe3c3e5c29fc

  • SHA256

    9ec83314112951d92b0146f574b66a0dbf706fc4741c610e851f54f2fbfecd0a

  • SHA512

    e0089ca88048dabef6e9fe9565867ab84d8083383cfb7e33eb7b09609c940353f81626a4bf4e4561a713a9a29d333d2dcd3e2b49e1ca34a56209a28d038d7b65

  • SSDEEP

    98304:RAa9fmUgT94N9DaGhN9FmBqXGpU+numsXh+3UjGa:1V7gTKF9ABq0nSY3Uj

Malware Config

Targets

    • Target

      9ec83314112951d92b0146f574b66a0dbf706fc4741c610e851f54f2fbfecd0a

    • Size

      4.0MB

    • MD5

      d6726e58e827b86f19edbf24045a8a5b

    • SHA1

      511a55b5c461888260b7e5ac6a9efe3c3e5c29fc

    • SHA256

      9ec83314112951d92b0146f574b66a0dbf706fc4741c610e851f54f2fbfecd0a

    • SHA512

      e0089ca88048dabef6e9fe9565867ab84d8083383cfb7e33eb7b09609c940353f81626a4bf4e4561a713a9a29d333d2dcd3e2b49e1ca34a56209a28d038d7b65

    • SSDEEP

      98304:RAa9fmUgT94N9DaGhN9FmBqXGpU+numsXh+3UjGa:1V7gTKF9ABq0nSY3Uj

    • YTStealer

      YTStealer is a malware designed to steal YouTube authentication cookies.

    • YTStealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks