Extracted

• • Target
    Proton Vpn Installer.exe
  • Size 4.7MB
  • SHA256 19b3c0b407d7ed23f23f65a2eac406403b2e9556a0ab40f2dc7172a09fb1679b
  • MD5 ad0afb80cbf03f4ee57b8051efd97411
  • SHA1 88c04f7c968a2fdfc292c8daa64b713def85d130
  • SHA512 6c4ae22c9ea90ae742faccdeb63d16fbef3ce97d9cad42afd277e72644338ed805c4c5d0adeb81aedb96d3fba07bcd433a118d9301ee48b93cbf41d612d94705
  • SSDEEP 98304:EKCdwf95mOekURF6SgUpww4ZVDT4ekQq9xRNKxY42BmuVQ+d7E9goV:Ezd+GNgUywuDT4aSzN1f2+d7UgoV
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  redlineytstealerinfostealerstealerupxspyware

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer

  • YTStealer payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2