General

  • Target

    malware_smoke_95845919

  • Size

    4.0MB

  • Sample

    221004-st31tabffm

  • MD5

    f2b90caf89abf936fa91a9b007330174

  • SHA1

    f6d40b9d09088cbc360afc0e0402d6dca5a8dac2

  • SHA256

    c1eae8655ba2f8afc1fdba12f836ad4ba4d26057109b8f70519aba2b88c9b92b

  • SHA512

    87bbf70f746b64191cb5075157a9de13852626d1cf49f85695da2ebc53d7712e4f6039f0aedda0842294bd670e14b43800b97e0c0acb9f3711a055e3feb6f5b0

  • SSDEEP

    98304:r0w4bFKyOF2oGgYUIjn+xU9jzv/4hbznwSIFnRL:rp4RKElgY7n+kzva+R

Malware Config

Targets

    • Target

      malware_smoke_95845919

    • Size

      4.0MB

    • MD5

      f2b90caf89abf936fa91a9b007330174

    • SHA1

      f6d40b9d09088cbc360afc0e0402d6dca5a8dac2

    • SHA256

      c1eae8655ba2f8afc1fdba12f836ad4ba4d26057109b8f70519aba2b88c9b92b

    • SHA512

      87bbf70f746b64191cb5075157a9de13852626d1cf49f85695da2ebc53d7712e4f6039f0aedda0842294bd670e14b43800b97e0c0acb9f3711a055e3feb6f5b0

    • SSDEEP

      98304:r0w4bFKyOF2oGgYUIjn+xU9jzv/4hbznwSIFnRL:rp4RKElgY7n+kzva+R

    • YTStealer

      YTStealer is a malware designed to steal YouTube authentication cookies.

    • YTStealer payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Tasks