MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 39b2f8df45c1356963ad36795c5d739b1201ca4798fbcc016ed3316a8a30cc9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


YTStealer


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 39b2f8df45c1356963ad36795c5d739b1201ca4798fbcc016ed3316a8a30cc9a
SHA3-384 hash: 551039709eb9d6ed0e54ba65a95be73c2c13cd6a87a9052394c84776ee535145c28c81c0cfda3f8e75516eda3a823bd5
SHA1 hash: faca656638d948aab17b7fd2516ef6d18831ee3f
MD5 hash: cf9c0885f61ff3c1f2b17422e9cf45b9
humanhash: lactose-item-december-artist
File name:file
Download: download sample
Signature YTStealer
Create hunting rule
File size:4'232'704 bytes
First seen:2022-08-23 19:15:03 UTC
Last seen:2022-08-24 03:42:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9aebf3da4677af9275c461261e5abde3 (25 x YTStealer, 12 x CobaltStrike, 11 x Hive)
ssdeep 98304:UPIhsXPGWXMKtHJWiLPLKzhXHaym7nHMsh5U3A2dGRbw0zVsQi84:QIktXFJLCHT2nHM+5spkTVYr
Threatray 99 similar samples on MalwareBazaar
TLSH T158163344F1B49B2E1F22C3FBAF062AC42AF0680DBB14A983795B64712C7B5146D74FE5
TrID 64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12)
25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe YTStealer


Avatar
andretavare5
Sample downloaded from http://164.92.158.1/a8573a/bfB48.exe

Intelligence

File Origin
# of uploads :
3
# of downloads :
377
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
file
Verdict:
No threats detected
Analysis date:
2022-08-23 19:17:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c8151c16-031a-481d-b0f2-e2d84298f180

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/300664/
Detection(s):
SecuriteInfo.com.W64.Agent.EBR.genEldorado.6288.10618.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a file in the system32 subdirectories
Creating a file
Launching a process
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/630527b313d4422dbbbcdf4b/reports/50c4a333-3c7d-4a6f-9110-e744b6cae77f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
YTStealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/affd4e0d-9361-49ab-81d7-6187d318c204
Result
Threat name:
YTStealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/1056603
Signature
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected YTStealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 689116 Sample: file Startdate: 23/08/2022 Architecture: WINDOWS Score: 68 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected YTStealer 2->28 7 file.exe 2->7         started        process3 dnsIp4 24 goback.delivery 104.21.84.12, 443, 49745 CLOUDFLARENETUS United States 7->24 30 Tries to harvest and steal browser information (history, passwords, etc) 7->30 11 powershell.exe 13 7->11         started        14 powershell.exe 12 7->14         started        16 powershell.exe 12 7->16         started        signatures5 process6 signatures7 32 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 11->32 34 Queries memory information (via WMI often done to detect virtual machines) 11->34 18 conhost.exe 11->18         started        20 conhost.exe 14->20         started        22 conhost.exe 16->22         started        process8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/39b2f8df45c1356963ad36795c5d739b1201ca4798fbcc016ed3316a8a30cc9a/
Threat name:
Win64.Adware.RedCap
Create hunting rule
Status:
Malicious
First seen:
2022-08-23 19:16:46 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
15 of 26 (57.69%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hgzprx2fye2wsy5ngz4vyxlttmjadsshtd54yalo2mywvcrqzsna._file
Verdict:
suspicious
Similar samples:
1117aa3d97baa3fcc4cd60f695fb47ccef86fde7b3ffe7a26e6fe9c33a8b9c41
YTStealer
162167cc828134b6c0d08d5fc503955b4ee1a0a3efdc001709a6947be15ed3bd
YTStealer
1901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901
YTStealer
2537af94a4828edf5b859e4af8ddad46d740b317e7812c30f7402ac55f64f2e9
YTStealer
2f92554a407ab10b4d8485ab5924f7ed2a52dedc735a21b828dba224d839391e
YTStealer
8f22fed63b011354380ce229b053b3b9167d66d37506acd6288886cf526edefe
YTStealer
adadc8e69ed95353daf38d970dcecffdde40cafc24fefd37db059ff19fcf2c79
YTStealer
caaa0d88dcfbd0e017a9b0b6c25cbdddc3e1bf27f2c96608989cd82ca6c47d36
YTStealer
f524babf2428be1c97d53f2c6508e9e851ff869d47f6957d9a71178308790200
YTStealer
faa3e926d4b9981b4b21a9c5a2cd61dd573b8eee6938a9519dbdfcabb32073c2
YTStealer
+ 89 additional samples on MalwareBazaar
Result
Malware family:
ytstealer
Create hunting rule
Score:
  10/10
Tags:
family:ytstealer spyware stealer upx
Link:
https://tria.ge/reports/220823-xys4mabdc4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Reads user/profile data of web browsers
UPX packed file
YTStealer
YTStealer payload
Unpacked files
SH256 hash:
9b6c01b4bae54eb95488572a8fe127541f226588c1576bf1d6197750a2bdb5e0
MD5 hash:
36a022fac83631c80a3e06cf14d89129
SHA1 hash:
b6d004bd05a5c6c8d355f655931351b25ad0b0c8
Link:
https://www.unpac.me/results/62da567c-1726-4a9a-8b12-69f132fa06ec/
SH256 hash:
39b2f8df45c1356963ad36795c5d739b1201ca4798fbcc016ed3316a8a30cc9a
MD5 hash:
cf9c0885f61ff3c1f2b17422e9cf45b9
SHA1 hash:
faca656638d948aab17b7fd2516ef6d18831ee3f
Link:
https://www.unpac.me/results/62da567c-1726-4a9a-8b12-69f132fa06ec/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/39b2f8df45c1356963ad36795c5d739b1201ca4798fbcc016ed3316a8a30cc9a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/300664/
  
URLhaus
https://urlhaus.abuse.ch/url/2276305/

Comments