General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3E1bmFOazh3Y0NfNlV3eVBfS2o4Z3pKV0NUZ3xBQ3Jtc0tsX2NuM0JuUElkV1lTdmFZTUxMLThPUFFVN2tFcDFVZTFoMXBrN0NXVXFkNGlkSUtCRnQ3bDhvem5HcDd6ZUxPZ0E1djFNUEM5anN4bVBYRWpEZWIzYWlhNmNzOTZEcmtmRlNRZ3NJbHUxd1l2dDZSVQ&q=https%3A%2F%2Ft.me%2Fflisk_drops&v=WkB1f2dcx_M
-
Sample
240524-zts9yaah7w
Malware Config
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa3E1bmFOazh3Y0NfNlV3eVBfS2o4Z3pKV0NUZ3xBQ3Jtc0tsX2NuM0JuUElkV1lTdmFZTUxMLThPUFFVN2tFcDFVZTFoMXBrN0NXVXFkNGlkSUtCRnQ3bDhvem5HcDd6ZUxPZ0E1djFNUEM5anN4bVBYRWpEZWIzYWlhNmNzOTZEcmtmRlNRZ3NJbHUxd1l2dDZSVQ&q=https%3A%2F%2Ft.me%2Fflisk_drops&v=WkB1f2dcx_M
Score8/10-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-