General
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbG04Nkg5N3NVRUtueHR6bHJoSkQ4ZG5Ga01Ld3xBQ3Jtc0tuZk04TzV2SGduUE04YkNvVXYyczVVdDY4RVpQbmdQLUlJNFR5Z0VWbjFzRElKNjJhMGFUVWQ3M21vblROcE9WckF2NzRiN1g5NUczN0J0MFJCc1V0UHRlWjFwMEN3QWlzMjdfYXdoQ0NNZ1VQd2Rzbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fugjgbtv7bgef6%2FExlauncher&v=oXjNemmUDT4
-
Sample
240812-lwnkkswarn
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbG04Nkg5N3NVRUtueHR6bHJoSkQ4ZG5Ga01Ld3xBQ3Jtc0tuZk04TzV2SGduUE04YkNvVXYyczVVdDY4RVpQbmdQLUlJNFR5Z0VWbjFzRElKNjJhMGFUVWQ3M21vblROcE9WckF2NzRiN1g5NUczN0J0MFJCc1V0UHRlWjFwMEN3QWlzMjdfYXdoQ0NNZ1VQd2Rzbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fugjgbtv7bgef6%2FExlauncher&v=oXjNemmUDT4
Resource
win10v2004-20240802-en
Malware Config
Extracted
stealc
cr7
http://45.152.115.5
-
url_path
/587ec30955d49a9c.php
Targets
-
-
Target
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbG04Nkg5N3NVRUtueHR6bHJoSkQ4ZG5Ga01Ld3xBQ3Jtc0tuZk04TzV2SGduUE04YkNvVXYyczVVdDY4RVpQbmdQLUlJNFR5Z0VWbjFzRElKNjJhMGFUVWQ3M21vblROcE9WckF2NzRiN1g5NUczN0J0MFJCc1V0UHRlWjFwMEN3QWlzMjdfYXdoQ0NNZ1VQd2Rzbw&q=https%3A%2F%2Fwww.mediafire.com%2Ffolder%2Fugjgbtv7bgef6%2FExlauncher&v=oXjNemmUDT4
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-