ytstealer | 99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b

Analysis

max time kernel
8s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
15/09/2022, 03:32

Target
99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe
Size 4.0MB
Sample220915-d3tfeabhc3
SHA256 99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b
MD5 38069d06debf35bab01ffab2d69876b1
SHA1 d475a44c97c07aa79a0a91d93985377217936479
SHA512 b94d2791a4d5b075dedeab358af12a616b96506df85aa501bc46ce77f939bdd1617aef2023290235fa8228312b60c2ac3f8d4d96e62a3063cfe1dd38ad492686
SSDEEP 98304:bRCkykrmWvZ9mh8vnxeLHIuvthFNHmcTCqHmhQ13I1AfMGHo:bRCsmWvHmwxwRvth3H1CSmhg5UGH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
stealer ytstealer

YTStealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/4236-119-0x00000000008C0000-0x0000000001689000-memory.dmp	family_ytstealer

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4236-119-0x00000000008C0000-0x0000000001689000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4236	99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe
4236	99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe
4236	99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe
4236	99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe

C:\Users\Admin\AppData\Local\Temp\99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe
"C:\Users\Admin\AppData\Local\Temp\99397f1c6ff002c0e52ce8dbcfc6341d2592d8c7a12462adb0efc3450cfcd34b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4236

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4236-119-0x00000000008C0000-0x0000000001689000-memory.dmp

Download