Extracted

• • Target

    Setup.exe

  • Size

    5.4MB

  • MD5

    30697215893fca2f6188cdcd7f3ddedf

  • SHA1

    07ebbdfecb6bab757dc71e5d94ddf02756ffb94f

  • SHA256

    37fab777eed6ae75d322c8d57ddb6294a2599daa332041bb093e002904a9e0e7

  • SHA512

    73ff33fb60cbb6dae797e328f5fcc9affaed8412e76fa8307c5f264d5c2178220e7be703821a063ecace1cc635de1c550dcd8342fcb9865541b25825dcae0e47

  • SSDEEP

    24576:34wsvYyY7XdKoFMHUoigrfEjnDnwViw8quVaBfGgzxoRjADVLZDFgyThCl3RuQ57:Iw7S2wAqNBfGgNoRjADV4l3B

  Score

  10^/10

  systembcytstealerspywarestealertrojanupx

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses 2FA software files, possible credential harvesting

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2