MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YTStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41
SHA3-384 hash: 3ffa9ad54f0bd7c370ecd6291756b1ea36b1c2a4878384d843ab0706d2c9c3cfc64e6ca5e2dc60351bed218cdb3550da
SHA1 hash: 388a76eb7baaec085d717dbb7c0f14cfa451018e
MD5 hash: dde97d310422b2d40e939f386eff5fcf
humanhash: twenty-lion-lion-five
File name:file
Download: download sample
Signature YTStealer
Create hunting rule
File size:4'229'632 bytes
First seen:2022-08-22 15:33:01 UTC
Last seen:2022-08-23 11:52:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9aebf3da4677af9275c461261e5abde3 (25 x YTStealer, 12 x CobaltStrike, 11 x Hive)
ssdeep 98304:Vvqq8Lf7vt1b74jc8+9eemmaP1r3AVMn:Aq67vMw8+9ZmLP1rQyn
TLSH T1691633E2705752EDF91EBC7972085EC43A194FEC5C4919BE5880E90D89308AABD43F9F
TrID 64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12)
25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe YTStealer


Avatar
andretavare5
Sample downloaded from https://cdn.discordapp.com/attachments/1005487487826788395/1010578022623100928/1234.bmp

Intelligence

File Origin
# of uploads :
7
# of downloads :
361
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-08-22 15:40:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/bb87eb6b-dfea-48b6-93e1-1096745f3be7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300304/
Detection(s):
SecuriteInfo.com.ArtemisDDE97D310422.32283.4011.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the system32 subdirectories
Creating a file
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/6303a23705ef0c24e41e6dab/reports/c80c63b5-d4c7-48d0-b6b6-a7324786bef2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
YTStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/15ff7917-ee07-4704-b0c5-cab12b3987f3
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1055703
Signature
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41/
Threat name:
Win64.Infostealer.Goback
Create hunting rule
Status:
Malicious
First seen:
2022-08-22 15:34:25 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
15 of 26 (57.69%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cel2upmxxkr7zrgnmd3jl62hztxyn7phwp76piton7u4goultraq._file
Verdict:
suspicious
Result
Malware family:
ytstealer
Create hunting rule
Score:
  10/10
Tags:
family:ytstealer spyware stealer upx
Link:
https://tria.ge/reports/220822-sy682ahgdl/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
UPX packed file
YTStealer
YTStealer payload
Unpacked files
SH256 hash:
b2f7b02d057c801ebced9554f19d1708c6e834fa14643b20d6e014d40c325c33
MD5 hash:
bcc4be603e34a81e576d2c3095b8973f
SHA1 hash:
f149cca0930dcf43bdf0bfcdde8955b44c160eee
Link:
https://www.unpac.me/results/57d42de3-299c-42d5-910d-0eb0f5a8078f/
SH256 hash:
1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41
MD5 hash:
dde97d310422b2d40e939f386eff5fcf
SHA1 hash:
388a76eb7baaec085d717dbb7c0f14cfa451018e
Link:
https://www.unpac.me/results/57d42de3-299c-42d5-910d-0eb0f5a8078f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/300304/

Comments